Windows StateRepository API: Tampering due to missing authentication

Summary

A missing authentication check for a critical function in the Windows StateRepository API allows an authorized local user with low privileges to tamper with data. The impact is limited to integrity and availability, with no confidentiality loss. The attack requires local access and a valid user account, so the risk is highest on multi-user systems such as terminal servers and shared PCs.

Affected

• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.33822 per CVE record; a third-party mirror lists 10.0.26100.9974, unresolved)
• Windows 11 Version 25H2 (10.0.26200.0 before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 before 10.0.26300.9974)
• Windows Server 2019 including Server Core (10.0.17763.0 before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 before 10.0.20348.5870)
• Windows Server 2025 including Server Core (10.0.26100.0 before 10.0.26100.33822)

Fixed in

• Security updates released with November 2026 Patch Tuesday
• Windows 10 Version 21H2: KB5131096 (third-party tracker, not verified against Microsoft's catalogue)
• Windows Server 2022: KB5131090 (third-party tracker, not verified against Microsoft's catalogue)
• Exact fixed build per edition: check the MSRC advisory, as sources conflict for Windows 11 Version 24H2

Workaround

Unknown.

Exploitation

• Not known to be exploited (CISA SSVC: Exploitation none)
• No public proof of concept found
• CVSS temporal vector uses E:U (exploit code maturity: unproven)

Our recommendation

• Install the November 2026 security updates on all affected Windows systems in the normal monthly patch cycle
• Prioritise terminal servers, shared PCs and Windows 10 systems still on extended support
• Check the extended support (ESU) and lifecycle status of each Windows 10 device
• Limit local user accounts on multi-user systems to the necessary minimum
• Check the MSRC advisory for the exact fixed build of each edition and monitor for changes in exploitation status

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-95998 msrc.microsoft.com
• CVE Record CVE-2026-95998 www.cve.org
• Strix.ai: CVE-2026-95998 www.strix.ai
• Senserva KB5131096 (Windows 10 21H2) senserva.com
• Senserva KB5131090 (Windows Server 2022) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:13.