Windows Shell: Elevation of privilege through type confusion
Summary
A type confusion flaw (CWE-843) in Windows Shell allows an authorized local user to elevate privileges on affected Windows 10, Windows 11 and Windows Server systems. The attacker needs a low-privileged local account and code execution as that user, so the flaw cannot be used remotely. The CVSS score is 7.8 (high), with high impact on confidentiality, integrity and availability.
Affected
- Windows 10 Version 1607 (before 10.0.14393.9688)
- Windows 10 Version 1809 (before 10.0.17763.9487)
- Windows 10 Version 21H2 (before 10.0.19044.7846)
- Windows 10 Version 22H2 (before 10.0.19045.7846, from a third-party source, unverified)
- Windows 11 Versions 23H2, 24H2, 25H2, 26H1 and 26H2 (builds as listed in the CVE record)
- Windows Server 2016, 2019 and 2022, including Server Core installations (builds as listed in the CVE record)
Fixed in
- Security update with the builds listed above or later, as published by Microsoft
- Windows 10 1607: 10.0.14393.9688
- Windows 10 1809: 10.0.17763.9487
- Windows 10 21H2: 10.0.19044.7846
- Windows 10 22H2: 10.0.19045.7846 (unverified)
- KB article numbers: Unknown.
Workaround
Unknown.
- No vendor-documented workaround found. Apply the security update.
Exploitation
- Not known to be exploited, according to the OffSeq aggregator. Its note is ambiguous.
- No public proof of concept found.
- CISA SSVC: exploitation none, not automatable, total technical impact.
Our recommendation
- Install the November 2026 Windows security update on all affected systems, starting with terminal servers, RDS/Citrix hosts and shared PCs.
- Check each build against the MSRC table. Do not assume that Windows 11 or 22H2 are covered by the 1607, 1809 or 21H2 numbers.
- Check whether Windows 10 1607 or 1809 is still in use and still supported.
- Monitor multi-user systems for unexpected privilege changes and for untrusted files being executed.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Shell
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation more likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131085, KB5131090, KB5131096, KB5131080, KB5131077, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide msrc.microsoft.com
- CVE.org CVE Record www.cve.org
- OffSeq Threat Radar radar.offseq.com
- Strix CVE mirror (unverified version data) www.strix.ai
- Qualys Patch Tuesday review, November 2026 blog.qualys.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:25.
Original description (NVD)
Access of resource using incompatible type ('type confusion') in Windows Shell allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.