Microsoft Windows: Privilege escalation in Volume Shadow Copy

Summary

An untrusted pointer dereference in the Windows Volume Shadow Copy component allows a local, unauthorized attacker to elevate privileges. According to the CVSS vector, the attack requires low complexity, no privileges and user interaction, and the impact is high for confidentiality, integrity and availability. An attacker would typically need local code execution or an interactive session first, for example after phishing.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Windows 10 Version 1607 / Windows Server 2016: build 10.0.14393.9688 or later
• Windows 10 Version 1809 / Windows Server 2019: build 10.0.17763.9487 or later
• Windows 10 Version 21H2: build 10.0.19044.7846 or later
• Windows 10 Version 22H2: build 10.0.19045.7846 or later
• Windows 11 Version 23H2: build 10.0.22631.7711 or later
• Windows 11 Version 24H2 / 25H2 / 26H2: build 10.0.26100.9974, 10.0.26200.9974 or 10.0.26300.9974 or later
• Windows 11 Version 26H1: build 10.0.28000.3501 or later
• Windows Server 2022: build 10.0.20348.5870 or later

Fixes are delivered through the cumulative update for each branch. KB numbers: Unknown.

Workaround

Unknown. No workaround is described in the sources. Patching is the expected remediation.

Exploitation

• No evidence of exploitation in the wild found.
• No public proof of concept found.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• Status in the CISA KEV catalogue: not verified.

Our recommendation

• Patch all affected Windows 10, Windows 11 and Windows Server systems with the cumulative update for their branch.
• Prioritise older Windows 10 builds (1607, 1809, 21H2, 22H2) and check whether they are still in use or supported.
• Verify the full affected list and KB numbers on the MSRC advisory before closing the item.
• Check systems that rely on Volume Shadow Copy for backups, as shadow copies are a common ransomware target.
• Monitor for unusual local privilege escalation activity and review the KEV catalogue and NVD once analysed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-119941 msrc.microsoft.com
• CVE Record: CVE-2026-119941 www.cve.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:37.