Microsoft Windows Kernel Transaction Manager: Use-after-free privilege escalation

Summary

A use-after-free vulnerability in the Windows Kernel Transaction Manager allows an authorized local attacker to elevate privileges. The attacker needs a valid low-privilege logon on the affected system, and exploitation is rated as high complexity. The flaw is not reachable from the internet, but it is relevant for shared systems such as terminal servers and file servers where several users have local logons.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 before 10.0.26300.9974)
• Windows Server 2016, including Server Core (10.0.14393.0 before 10.0.14393.9688)
• Windows Server 2019, including Server Core (10.0.17763.0 before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 before 10.0.20348.5870)

Fixed in

• Security update from Microsoft's November 2026 Patch Tuesday release
• Fixed builds: 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974, 10.0.20348.5870
• KB article numbers: Unknown. See the MSRC update guide.

Workaround

Unknown. No Microsoft or third-party workaround was found. Install the security update.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• CVSS exploit maturity is unproven (E:U).
• No public proof of concept found.

Our recommendation

• Install the November 2026 security update on all affected systems, starting with terminal servers, shared workstations and file servers.
• Check that Windows 10 1607 and 1809 systems are still eligible for security updates.
• Limit local logons on servers to necessary accounts and review privileged accounts.
• Monitor for unusual privilege changes and new administrative accounts.
• Verify the affected build list against the MSRC update guide before rollout.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-94522 www.cve.org
• Microsoft Security Update Guide CVE-2026-94522 msrc.microsoft.com
• BleepingComputer: Microsoft November 2026 Patch Tuesday www.bleepingcomputer.com
• Rapid7: Patch Tuesday November 2026 www.rapid7.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:11.