Windows Storage Spaces CVE-2026-87716

Exploitation requires the target host to be running the Windows Storage Spaces Controller and to have the relevant network service reachable by the attacker; per CVSS PR:N/UI:N the attack needs no authentication and no user interaction against affected default-serviceable builds. The practical LIMITING factor is network reachability of the Storage Spaces service - hosts where this service is not network-exposed (e.g., segmented storage networks or firewalled management interfaces) are not reachable remotely. Impact is confined to availability (service/system crash); there is no confidentiality or integrity exposure, so this cannot be chained directly into data theft or code execution based on the provided data. Affected builds span Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the listed patched build numbers.

This is a medium-to-high priority denial-of-service issue, not a critical system-compromise flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated condition requiring no user interaction, and the impact is scoped purely to availability (C:N/I:N/A:H) - consistent with the description of a network DoS rather than code execution. CISA's SSVC framework reinforces this reading: Exploitation is rated 'none' (no observed exploitation), Automatable is 'yes' (the attack can be scripted/scaled), and Technical Impact is 'partial' (availability loss, not total control). The signals are internally consistent and do not conflict. However, key triage signals are MISSING: no EPSS probability was provided, this CVE is NOT on CISA KEV, and no public POC is indicated - so the real-world exploitation likelihood cannot be quantified and should be treated as currently theoretical. The combination of 'exploitation: none' plus 'automatable: yes' suggests that while no attacks are observed today, a working exploit could be weaponized for broad scanning if one emerges. Given the enormous Windows install base, patch promptly, but this ranks below any RCE or privilege-escalation flaw of comparable CVSS.

A remote, unauthenticated attacker sends specially crafted network traffic to a Windows host running the Storage Spaces Controller, triggering a heap-based buffer overflow (CWE-122) that corrupts memory and crashes the service or system, denying storage/service availability. No authentication or user interaction is required per the CVSS vector. No public exploit code has been identified at time of analysis, so this remains a plausible but unproven attack path.