Microsoft Windows Storage: Use-after-free elevation of privilege

Summary

A use-after-free vulnerability in the Windows Storage component allows an authorized local attacker with a low-privileged account to elevate privileges. Successful exploitation requires winning a race condition, and a successful attack would grant SYSTEM rights. The flaw is not remotely exploitable and is mainly relevant as a follow-up step after an attacker has already gained a foothold on a system.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds below 10.0.17763.9376
• Windows 10 Version 21H2: builds below 10.0.19044.7807
• Windows 10 Version 22H2: builds below 10.0.19045.7807
• Windows 11 Version 23H2: builds below 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2, Windows 11 Version 26H2: builds below 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711 respectively
• Windows 11 Version 26H1: builds below 10.0.28000.3231
• Windows Server 2022: builds below 10.0.20348.5761
• Windows Server 2025 (including Server Core): builds below 10.0.26100.33650

Fixed in

• Install Microsoft's October 2026 security updates (released 13 Oct 2026) for the affected Windows version.
• Fixed builds: see the list above (first build that is not affected).
• Cumulative update names reported by third parties, not yet verified: KB5126651 (Windows 10 1809 / Server 2019), KB5126646 (Server 2025), KB5126653 (Windows 11 23H2).

Workaround

Unknown.

• No workaround or mitigation is documented in the sources. The security update is the remediation.

Exploitation

• Microsoft rates exploitation as "Exploited: No" and exploit code maturity as "Unproven".
• No public proof of concept or exploit was found in the sources checked. This is not proof that none exists.
• As of 4 Nov 2026, no known exploitation according to the available sources.
• Attack vector: local. Attack complexity: high (race condition). Privileges required: low.

Our recommendation

• Patch in the October 2026 update cycle, with priority on terminal servers, shared workstations and hosts with untrusted local users.
• Check whether any systems still run Windows 10 1809 or 21H2 and confirm their support status on Microsoft's lifecycle page.
• Verify the KB numbers and fixed builds in the Microsoft Security Update Guide before rollout.
• On multi-user systems such as RDS or terminal servers, restrict local logon to trusted users.
• Monitor for unusual privilege escalation on endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69935 msrc.microsoft.com
• Vulners CVELIST: CNA version ranges vulners.com
• Vulners NVD: NVD ranges and KB references vulners.com
• Vulners MSCVE: additional range data vulners.com
• BDU FSTEC: CVE-2026-69935 record vulners.com
• Strix: CVE-2026-69935 (secondary source) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:28.