Microsoft Windows 11: Elevation of privilege in Windows Bind Filter Driver
Summary
Weak authentication in the Windows Bind Filter Driver of Windows 11 allows a local user with low privileges to elevate their privileges. The attacker needs an existing local account, such as a compromised standard user account, and no user interaction is required. The CVSS base score is 7.8 (High), and the NVD analysis was still pending at the time of writing.
Affected
- Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
- Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
- Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
- Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
- Windows Server and Windows 10: not confirmed in the sources reviewed.
Fixed in
- Windows 11 24H2: build 10.0.26100.9974 (KB5132061, November 10, 2026)
- Windows 11 25H2: build 10.0.26200.9974 (KB5132061, November 10, 2026)
- Windows 11 26H1: build 10.0.28000.3501 (KB5132059, November 10, 2026)
- Windows 11 26H2: build 10.0.26300.9974 (KB5132061, November 10, 2026)
Workaround
Unknown. No vendor workaround was found. Apply the security update.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in the CISA KEV catalog.
- No public proof of concept found at the time of writing.
- The CVSS temporal vector indicates unproven exploit maturity (E:U); this is a reading of the vector, not a Microsoft statement.
Our recommendation
- Install the November 2026 cumulative update on all affected Windows 11 endpoints during the normal patch window, prioritising shared, multi-user and RDS systems.
- Check that the installed build meets or exceeds the fixed build for your version.
- Upgrade Windows 11 24H2 Home and Pro devices to 25H2 or 26H2, because 24H2 support has ended and these devices no longer receive updates.
- Re-check the MSRC advisory and NVD, as the CVSS and CWE data may change.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-70182 msrc.microsoft.com
- CVE Record: CVE-2026-70182 www.cve.org
- Windows 11 KB5132061 and KB5131087 cumulative updates released (BleepingComputer) www.bleepingcomputer.com
- KB5132061 (Senserva) senserva.com
- KB5132059 (Senserva) senserva.com
- Windows 11 KB5132061 November 2026 Patch Tuesday updates (Windows Report) windowsreport.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:23.
Original description (NVD)
Weak authentication in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.