CVE-2026-88245: Windows Brokering File System Elevation of Privilege Vulnerability

Q: Who can exploit this vulnerability?

An attacker must already be authorized on the affected system and have local access. The provided information does not indicate that remote, unauthenticated exploitation is possible.

Q: What level of impact could successful exploitation have?

Successful exploitation can allow local privilege elevation and may affect confidentiality, integrity, and availability. The severity vector rates all three impacts as high.

Q: Which product is identified as affected?

The provided data identifies Microsoft Windows Server 2025 as affected.

Published Nov 10, 2026

Updated

Missing authentication for critical function in Windows Brokering File System allows an authorized attacker to elevate privileges locally.

Other sources

Windows Brokering File System Elevation of Privilege Vulnerability

— Microsoft

Affected Software

2 affected componentsFixes available

Microsoft Windows Server 2025<10.0.26100.33822, <10.0.26100.33730

10.0.26100.3382210.0.26100.33730

Microsoft Windows Server 2025<10.0.26100.33822, <10.0.26100.33730

10.0.26100.3382210.0.26100.33730

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33822Fixed in 10.0.26100.33730Patch KB5131077

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:17 PM

Data Sourced

via MITRE·06:17 PM

DescriptionSeverity

Data Sourced

via NVD·07:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must already be authorized on the affected system and have local access. The provided information does not indicate that remote, unauthenticated exploitation is possible.

What level of impact could successful exploitation have?

Successful exploitation can allow local privilege elevation and may affect confidentiality, integrity, and availability. The severity vector rates all three impacts as high.

Which product is identified as affected?

The provided data identifies Microsoft Windows Server 2025 as affected.

CVE-2026-88245: Windows Brokering File System Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What level of impact could successful exploitation have?

Which product is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What level of impact could successful exploitation have?

Which product is identified as affected?