Microsoft Windows Servicing Stack Update: Local privilege escalation via confused deputy

Summary

A confused deputy flaw (CWE-441) in Microsoft's Servicing Stack Updates (SSU) allows an authorized local user to elevate privileges on affected Windows 10, Windows 11 and Windows Server systems. The attacker needs a valid low-privileged account on the machine and cannot exploit the flaw directly over the network. Microsoft rates the impact as high for confidentiality, integrity and availability (CVSS 3.1 7.8).

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9681)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846, per CVE record)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711, per CVE record)
• Windows Server 2016, including Server Core (builds before 10.0.14393.9681)
• Windows Server 2019, including Server Core (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)

Fixed in

• Windows 10 21H2 and 22H2: KB5131096 (builds 19044.7846 and 19045.7846); requires SSU 19044.6088 or later first
• Windows 10 1809: KB5131085 (build 17763.9487)
• Windows 10 1607: KB5131291 (build 14393.9688)
• Windows 11 23H2 and Windows Server 2016, 2019, 2022: Unknown. Confirm the KB per build in the MSRC update guide.
• Note: the KB for the SSU fix is not confirmed in a Microsoft source for every build.

Workaround

Unknown. No vendor-documented workaround is available. Restricting local logon and administrative rights reduces exposure, but this is not an official mitigation.

Exploitation

• Not known to be exploited in the wild (CISA SSVC: Exploitation none, Automatable no).
• Microsoft's exploitability index rates it "More likely" (a prediction, not a detection).
• No public proof-of-concept known according to ZDI.
• CISA KEV listing: not seen in research; verify in the catalog.

Our recommendation

• Install the November 2026 cumulative update, including the SSU, on all affected systems.
• For Windows 10 21H2 and 22H2, install KB5131096 after the required SSU; this build requires an ESU or Enterprise LTSC license.
• Prioritize shared workstations, Remote Desktop and terminal servers, and Windows 10 devices on end-of-support builds (1607, 1809, 21H2).
• Verify the KB for each build in the MSRC update guide before deployment.
• Limit local logon and administrative rights and monitor for unusual privilege changes on multi-user systems.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  crisprss/CVE-2026-88235

Research sources

• Microsoft Security Response Center: CVE-2026-88235 msrc.microsoft.com
• CVE Record CVE-2026-88235 www.cve.org
• Microsoft Support: KB5131096 Windows 10 21H2/22H2 security update support.microsoft.com
• Zero Day Initiative: November 2026 security update review www.zerodayinitiative.com
• Qualys: Microsoft Patch Tuesday November 2026 review blog.qualys.com
• NTCompatible: Microsoft November 2026 Patch Tuesday www.ntcompatible.com
• TrinetriOps: November 2026 Patch Tuesday (secondary) trinetriops.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:16.