Microsoft Windows Print Spooler: Information disclosure vulnerability
Summary
A vulnerability in the Windows Print Spooler components allows an authorized attacker to disclose sensitive system information over the network. The attacker needs a valid low-privilege account, and no user interaction is required. According to the CVSS vector, the impact is limited to confidentiality, with no integrity or availability impact.
Affected
- Windows 10 Version 1607, 1809, 21H2 and 22H2
- Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2
- Windows Server 2016, 2019 and 2022, including Server Core installations
- Affected build ranges are listed in the CVE record. Windows Server 2025 appears only in secondary sources and is unverified.
Fixed in
- Fixed in the November 2026 Windows security updates (per the Microsoft CNA record).
- Fixed builds per the CVE record: 10.0.14393.9688 (Windows 10 1607 and Server 2016), 10.0.17763.9487 (1809 and Server 2019), 10.0.22631.7711 (Windows 11 23H2).
- Fixed builds from a secondary source, not yet verified against MSRC: 10.0.19044.7846, 10.0.19045.7846, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974, 10.0.20348.5870.
- Unresolved conflict: one source gives 10.0.26100.33822 for build branch 26100 (24H2 and Server 2025).
- Check the MSRC advisory for authoritative build numbers and KB articles. Unknown: KB numbers.
Workaround
- Unknown. No vendor-documented workaround found.
- General hardening: disable the Print Spooler service on servers and domain controllers that do not need printing, and keep print services off untrusted network segments.
Exploitation
- No known exploitation in the wild at publication.
- No public proof of concept found.
- Microsoft exploit code maturity is Unproven (E:U). CISA SSVC: exploitation none, not automatable.
- CISA KEV status and EPSS score: unknown.
Our recommendation
- Install the November 2026 Windows security updates on all affected clients and servers, prioritising domain controllers, file servers and print servers.
- Verify installed build numbers against the MSRC advisory after patching.
- Disable the Print Spooler on systems that do not print.
- Restrict print service access to internal networks and monitor for unusual authentication or information access.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Information disclosure – Windows Print Spooler Components
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-112808 msrc.microsoft.com
- CVE Record: CVE-2026-112808 www.cve.org
- Microsoft November 2026 Patch Tuesday roundup cybersecuritynews.com
- Strix: CVE-2026-112808 (secondary, unverified) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:26.
Original description (NVD)
Exposure of sensitive system information to an unauthorized control sphere in Windows Print Spooler Components allows an authorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.