Microsoft Windows 11: Elevation of privilege in Windows Kernel-Mode Drivers
Summary
Improper access control in the Windows Kernel-Mode Drivers allows an authorized local attacker to elevate privileges to system level. The attacker needs low privileges, such as a standard user account or code already running as a logged-in user, and no user interaction. The flaw is not directly reachable from the internet, but it matters most on shared workstations, terminal servers and machines with stored credentials.
Affected
- Windows 11 Version 24H2: builds 10.0.26100.0 to before 10.0.26100.9711
- Windows 11 Version 25H2: builds 10.0.26200.0 to before 10.0.26200.9711
- Windows 11 Version 26H1: builds 10.0.28000.0 to before 10.0.28000.3231
- Windows 11 Version 26H2: builds 10.0.26300.0 to before 10.0.26300.9711
- Windows Server 2025 (including Server Core): builds 10.0.26100.0 to before 10.0.26100.33650 (fixed build taken from a single aggregator, not yet confirmed on MSRC)
- Older Windows versions: Unknown.
Fixed in
- Windows 11 24H2: 10.0.26100.9711 or later (per CNA version range)
- Windows 11 25H2: 10.0.26200.9711 or later
- Windows 11 26H1: 10.0.28000.3231 or later
- Windows 11 26H2: 10.0.26300.9711 or later
- Windows Server 2025: 10.0.26100.33650 or later (to be verified on MSRC)
- Fix is part of the monthly security update of 13 October 2026. The matching KB number for Windows 11 24H2 is Unknown; verify it on the MSRC page.
Workaround
Unknown. No vendor-published workaround was found. Apply the security update.
Exploitation
- No evidence of exploitation in the wild; not listed in CISA KEV (per OpenCVE)
- CISA SSVC assessment: exploitation none, automatable no, technical impact total
- No public proof of concept found
Our recommendation
- Install the October 2026 security update on all affected Windows 11 and Windows Server 2025 systems, prioritising shared workstations and terminal servers
- Verify the installed build number against the fixed versions above and check the MSRC page for the correct KB
- Limit local logon rights and remove unnecessary local accounts to reduce the chance of an attacker gaining an initial foothold
- Monitor endpoints for unusual privilege changes and new processes running as SYSTEM
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide (MSRC) msrc.microsoft.com
- OpenCVE record app.opencve.io
- Vulners NVD mirror vulners.com
- Vulners CVE list mirror (CNA data) vulners.com
- Strix summary www.strix.ai
- Tenable plugin page (KB5126646) www.tenable.com
- KernelSight triage issue github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:38.
Original description (NVD)
Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.