Microsoft Windows Feedback Hub: Privilege escalation via race condition

Summary

Windows Feedback Hub, a Store app included in supported Windows 10 and 11 clients and Windows Server 2022 and 2025, contains a race condition (CWE-362) that allows a local attacker to elevate privileges. The attacker first needs authorized low-privilege access to the machine, for example through a phished user account or malware running as a standard user. The CNA record and the CISA SSVC assessment show no known exploitation, and the attack is rated as complex (AC:H).

Affected

• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2: builds before 10.0.26100.9974
• Windows 11 Version 25H2: builds before 10.0.26200.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows 11 Version 26H2: builds before 10.0.26300.9974
• Windows Server 2022: builds before 10.0.20348.5870
• Windows Server 2025 (including Server Core): builds before 10.0.26100.33822
• Per-architecture scope is not fully confirmed in the sources; verify against the MSRC table.

Fixed in

• Fixed in the first non-vulnerable builds listed above, according to the CVE record.
• KB article numbers: Unknown.
• Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96075

Workaround

• No vendor workaround known. Patching is the fix.
• Analyst suggestion, not documented by the vendor: where Feedback Hub is not needed, remove the Store app to reduce the attack surface. Test this first, as the app can be reinstalled from the Microsoft Store.

Exploitation

• No known exploitation in the wild.
• No public proof of concept found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• CVSS 3.1 vector includes E:U (exploit code maturity Unproven).

Our recommendation

• Patch affected Windows 10 and 11 clients and Windows Server systems in the regular Patch Tuesday cycle, with higher priority on machines used by untrusted users.
• Confirm that Windows 10 21H2 and 22H2 machines still receive security updates (ESU or LTSC) before relying on patches.
• Consider removing Feedback Hub where it is not business-relevant, after testing.
• Monitor for suspicious privilege escalation on endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide msrc.microsoft.com
• CVE.org CVE Record www.cve.org
• Microsoft Support: Send feedback with the Feedback Hub app support.microsoft.com
• Microsoft Store: Feedback Hub apps.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:42.