What is the CVSS score of CVE-2026-26181?

CVE-2026-26181 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-26181?

Within 24 hours: Identify all Windows 11 (22H3-26H1) and Windows Server 2022/2025 systems in your environment using asset management tools. Within 7 days: Test the vendor-released patch in a controlled environment and deploy to non-critical systems to validate compatibility. Within 30 days: Complete full deployment of the patch to all affected Windows 11 and Windows Server systems via your patch management system, prioritizing servers and workstations with multi-user access or high-privilege service accounts.

Microsoft CVE-2026-26181

Q: Which versions of Microsoft are affected by CVE-2026-26181?

CVE-2026-26181 is a local privilege escalation affecting Microsoft's Brokering File System on Windows 11 and Windows Server 2022/2025 that allows low-privileged authenticated users to gain…. A patch is available.

EUVD-2026-22424 HIGH

Use After Free (CWE-416)

2026-04-14 microsoft

Denial Of Service Use After Free Memory Corruption Microsoft

7.8

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:14 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22424

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

HIGH 7.8

DescriptionCVE.org

Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Brokering File System on Windows 11 and Windows Server 2022/2025 allows authenticated users with low privileges to gain SYSTEM-level access via use-after-free memory corruption. The vulnerability affects all actively supported Windows 11 versions (22H3 through 26H1) and recent Windows Server editions. Exploitation requires local access and low-level user privileges (PR:L) but has low attack complexity (AC:L), enabling reliable exploitation once local access is obtained. No public exploit identified at time of analysis, though the use-after-free weakness class is well-understood by attackers.

Technical ContextAI

The Microsoft Brokering File System is a Windows kernel component responsible for managing file system operations and inter-process communication between applications and system resources. This vulnerability stems from a use-after-free condition (CWE-416), a memory corruption class where code continues to reference memory after it has been freed, allowing attackers to manipulate deallocated memory regions. By timing memory operations carefully, an attacker can control what data occupies the freed memory location, potentially redirecting execution flow or corrupting security-critical data structures. The affected CPE strings identify Windows 11 builds from 10.0.22631.0 through 10.0.28000.1836 and Windows Server 2022 23H2/2025 from 10.0.25398.0 through 10.0.26100.32690. The local attack vector (AV:L) indicates the vulnerability is exploitable only by authenticated users with existing system access, not remotely over network protocols.

RemediationAI

Apply the Microsoft-released security updates immediately through Windows Update or Windows Server Update Services. For Windows 11 22H2/23H2, update to build 10.0.22631.6936 or later. For Windows 11 24H2 and Windows Server 2025, update to build 10.0.26100.32690 or later. For Windows 11 25H2, update to build 10.0.26200.8246 or later. For Windows 11 26H1, update to build 10.0.28000.1836 or later. For Windows Server 2022 23H2 Edition, update to build 10.0.25398.2274 or later. No workarounds are documented; patching is the only effective mitigation. Organizations unable to patch immediately should prioritize systems with multiple user accounts, shared access, or internet-facing services where initial access risk is elevated. Review security logs for unusual privilege escalation attempts or suspicious kernel-mode activity. Detailed patch deployment guidance is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26181.