IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Windows Broker Infrastructure Service: Information disclosure

CVE-2026-96156Medium 5.5

← All vulnerabilities

Summary

Microsoft Windows Broker Infrastructure Service contains a use of uninitialized resource (CWE-908). A locally authenticated attacker with low privileges can read sensitive information, but cannot change data or disrupt the service. No user interaction is required. The CVSS base score is 5.5 (medium).

Affected

  • Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
  • Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
  • Windows 10 Version 21H2: builds before 10.0.19044.7846
  • Windows 10 Version 22H2: builds before 10.0.19045.7846
  • Windows 11 Version 23H2: builds before 10.0.22631.7711
  • Windows 11 Version 24H2: builds before 10.0.26100.9974
  • Windows 11 Version 25H2: builds before 10.0.26200.9974
  • Windows 11 Version 26H1: builds before 10.0.28000.3501
  • Windows 11 Version 26H2: builds before 10.0.26300.9974
  • Windows Server 2022: builds before 10.0.20348.5870

Fixed in

  • Install the Microsoft security update of November 10, 2026 for the affected Windows version. Examples: KB5131090 (Windows Server 2022) and KB5131085 (Windows Server 2019 and Windows 10 1809), according to secondary sources.
  • Fixed builds are listed in the affected section above (per the official CVE record).

Workaround

Unknown. No vendor workaround has been identified. Apply the security update.

Exploitation

  • Not known to be exploited in the wild.
  • CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
  • No public proof of concept identified.
  • Listing in the CISA KEV catalog not confirmed.

Our recommendation

  • Install the November 2026 cumulative update on all affected Windows systems in the normal monthly cycle.
  • Prioritise multi-user systems such as terminal servers, shared file and application servers, and workstations used by several people.
  • Confirm the patch path for Windows 10 1607 and 1809 devices that depend on Extended Security Updates (ESU).
  • Restrict local interactive logons on servers and apply least privilege.
  • Review the patch status of affected systems after installation.

Information from Microsoft (Patch Tuesday November 2026)

Severity (Microsoft)
Important
Impact
Information disclosure – Windows Broker Infrastructure Service
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5131085, KB5131090, KB5131096, KB5131080, KB5131077, KB5132061

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:18.

Original description (NVD)

Use of uninitialized resource in Windows Broker Infrastructure Service allows an authorized attacker to disclose information locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed