Windows Server 2025: Local privilege escalation in Brokering File System
Summary
A local elevation of privilege vulnerability in the Windows Brokering File System component affects Windows Server 2025, including Server Core installations. An attacker with a low-privileged local account or code running as a user can gain higher privileges, with the CVSS vector indicating full impact on confidentiality, integrity and availability. The CVE record lists the CWE as missing authentication (CWE-306), which is unusual for a local flaw, so the MSRC description should be checked. The vulnerability is not remotely exploitable on its own.
Affected
- Microsoft Windows Server 2025 (x64)
- Microsoft Windows Server 2025 (Server Core installation)
- Versions 10.0.26100.0 before 10.0.26100.33822
- Windows 11 is not listed in this CVE record
Fixed in
- Fixed build: 10.0.26100.33822 (derived from the CNA record; verify on the MSRC advisory)
Workaround
Unknown. No vendor-published workaround was found; patching is the expected remedy.
Exploitation
- No evidence of exploitation in the wild found
- CISA KEV: not listed
- No public proof of concept found
- CISA SSVC: exploitation none, automatable no, technical impact total
Our recommendation
- Patch Windows Server 2025 hosts in the normal monthly update cycle, starting with multi-user servers such as RDS/terminal servers and shared file servers
- Limit interactive logons and local accounts on servers to what is necessary
- Check whether any Windows 11 systems are affected under a separate CVE
- Monitor for unusual privilege changes on servers
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-88245 (CVE Program) www.cve.org
- MSRC Security Update Guide CVE-2026-88245 msrc.microsoft.com
- Strix CVE-2026-88245 www.strix.ai
- Windows forum: CVE-2026-50466 July updates (related Brokering File System flaw) windowsforum.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:14.
Original description (NVD)
Missing authentication for critical function in Windows Brokering File System allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.