What is the CVSS score of EUVD-2026-56328?

EUVD-2026-56328 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Network Connection Broker are affected by EUVD-2026-56328?

CVE-2026-61366 is a privilege escalation vulnerability in Windows Network Connection Broker (NCBroker) affecting Windows 10, 11, and Server editions 2012-2025, enabling authenticated local users to…. A patch is available.

How to fix or mitigate EUVD-2026-56328?

Within 24 hours, inventory all Windows systems (endpoints, servers, workstations) and identify those running affected versions (Windows 10, 11, 26H1, or Server 2012-2025) to prioritize patching. Within 7 days, deploy Microsoft's security patches for NCBroker to all critical infrastructure, domain controllers, and administrative workstations through your standard patch management process. Within 30 days, ensure all remaining affected Windows systems across your organization are updated to patched versions to eliminate the local privilege escalation attack surface.

Network Connection Broker EUVD-2026-56328

| CVE-2026-61366 HIGH

Double Free (CWE-415)

2026-08-11 secure@microsoft.com

GHSA-m4h5-7279-wf6j

Information Disclosure Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local session with low-privilege account required; AC:H reflects heap-timing or race-condition dependency typical of double-free exploitation; full triad impact from SYSTEM-level code execution on the vulnerable host.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 20:46 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 cve.org

HIGH 7.0

DescriptionCVE.org

Double free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation via double-free memory corruption in the Windows Network Connection Broker (NCBroker) service affects a broad swath of Microsoft Windows desktop and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An authenticated local attacker with low-privilege access can exploit heap corruption induced by the double-free condition (CWE-415) to elevate privileges to SYSTEM level. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exceptionally wide scope of affected Windows versions substantially broadens the attack surface for organizations with unpatched endpoints.

Technical ContextAI

The Windows Network Connection Broker is a system service (BrokerInfrastructure) that manages network connectivity state changes on behalf of UWP (Universal Windows Platform) applications. CWE-415 (Double Free) describes a condition where the same heap memory region is freed twice; in the context of a privileged Windows service, this typically enables heap-layout manipulation - an attacker crafts inputs or API call sequences to control the second free's effect on heap metadata, redirecting execution or overwriting function pointers to achieve privilege escalation. The affected CPE spans Windows NT kernel builds from 6.2.9200 (Server 2012) through 10.0.28000 (Windows 11 26H1), indicating the vulnerability exists in a long-standing code path shared across the entire modern Windows release family. The CVSS vector AV:L/AC:H/PR:L is consistent with a heap corruption primitive requiring precise timing or specific allocation patterns to exploit reliably.

RemediationAI

The primary remediation is to apply the Microsoft security update delivered through Windows Update or the Microsoft Update Catalog, patching affected systems to the fixed build versions confirmed in EUVD-2026-56328 and documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61366. Vendor-released patches exist for all listed affected versions. Where immediate patching is operationally infeasible, organizations should restrict local interactive logon and Remote Desktop Protocol access to explicitly authorized administrative accounts on affected systems, shrinking the pool of potential low-privilege attackers who could satisfy the PR:L prerequisite. Disabling the Network Connection Broker service (BrokerInfrastructure) is not recommended as a general workaround - doing so will break UWP and Windows Store application network connectivity and may impact system stability. Prioritize patching on shared workstations, VDI infrastructure, jump servers, and RDP-exposed endpoints where multiple users authenticate with standard accounts, as these environments most closely match the exploitation prerequisite.