CVE-2026-96097: Windows Brokering File System Elevation of Privilege Vulnerability

Q: Who is exposed to exploitation?

Systems running Microsoft Windows 11 are identified as affected. Exploitation is local, so an attacker must already have access to the system rather than being able to exploit it remotely.

Q: What level of access does an attacker need?

The attacker must be authorized and have low-level privileges on the affected system. No user interaction is required according to the provided vector.

Q: What could successful exploitation allow?

Successful exploitation could allow elevation of privilege. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability.

Published Nov 10, 2026

Updated

Release of invalid pointer or reference in Windows Brokering File System allows an authorized attacker to elevate privileges locally.

Other sources

Windows Brokering File System Elevation of Privilege Vulnerability

— Microsoft

Affected Software

8 affected componentsFixes available

Microsoft Windows 11=26H1, >=10.0.28000<10.0.28000.3501

10.0.28000.3501

Microsoft Windows 11=26H1, >=10.0.28000<10.0.28000.3501

10.0.28000.3501

Microsoft Windows 11=26H2, >=10.0.26300<10.0.26300.9974, >=10.0.26300<10.0.26300.9911

10.0.26300.997410.0.26300.9911

Microsoft Windows 11=25H2, >=10.0.26200<10.0.26200.9974, >=10.0.26200<10.0.26200.9911

10.0.26200.997410.0.26200.9911

Microsoft Windows 11=26H2, >=10.0.26300<10.0.26300.9974, >=10.0.26300<10.0.26300.9911

10.0.26300.997410.0.26300.9911

Microsoft Windows 11=25H2, >=10.0.26200<10.0.26200.9974, >=10.0.26200<10.0.26200.9911

10.0.26200.997410.0.26200.9911

Microsoft Windows 11=24H2, >=10.0.26100<10.0.26100.9974, >=10.0.26100<10.0.26100.9911

10.0.26100.997410.0.26100.9911

Microsoft Windows 11=24H2, >=10.0.26100<10.0.26100.9974, >=10.0.26100<10.0.26100.9911

10.0.26100.997410.0.26100.9911

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3501Patch KB5132059
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26300.9974Fixed in 10.0.26300.9911Patch KB5132043
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9974Fixed in 10.0.26200.9911Patch KB5132043
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9974Fixed in 10.0.26100.9911Patch KB5132043

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:17 PM

Data Sourced

via MITRE·06:17 PM

DescriptionSeverity

Data Sourced

via NVD·07:22 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to exploitation?

Systems running Microsoft Windows 11 are identified as affected. Exploitation is local, so an attacker must already have access to the system rather than being able to exploit it remotely.

What level of access does an attacker need?

The attacker must be authorized and have low-level privileges on the affected system. No user interaction is required according to the provided vector.

What could successful exploitation allow?

Successful exploitation could allow elevation of privilege. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability.

CVE-2026-96097: Windows Brokering File System Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to exploitation?

What level of access does an attacker need?

What could successful exploitation allow?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

What level of access does an attacker need?

What could successful exploitation allow?