CVE-2026-32091

What it actually does

This is a local elevation-of-privilege vulnerability in the Microsoft Windows Brokering File System caused by a race condition, where concurrent access to a shared resource is not synchronized correctly. An attacker who can execute code locally may be able to win the race and cause the Windows component to perform operations with higher privileges than intended, potentially resulting in SYSTEM-level or kernel-adjacent privilege escalation with high confidentiality, integrity, and availability impact. It is not a network-only remote code execution issue; exploitation requires local execution on an affected Windows client or server.

Why it matters to the business

Successful exploitation can turn an initial foothold on a Windows workstation or server into full administrative control of that machine. This can enable credential theft, security tool tampering, lateral movement, ransomware deployment, data theft, or persistence. Although EPSS is currently low and stable, there is no known CISA KEV listing, no ransomware association, and no reported mature public exploit in the provided data, the vulnerability is high severity and has been public for 120 days, so unpatched systems remain attractive targets if exploit code becomes available. The broad affected footprint across Windows 10, Windows 11, and multiple Windows Server releases increases operational exposure in enterprises with mixed Windows estates.

How an attack unfolds

An attacker first needs a way to run code on an affected Windows system, such as through phishing, malware, abuse of a remote access tool, stolen credentials, or exploitation of a separate application vulnerability. Once local execution is achieved, the attacker runs exploit code that repeatedly triggers the vulnerable Brokering File System behavior and attempts to manipulate timing between concurrent operations. If the race condition is won, the attacker causes privileged Windows code to act on attacker-influenced state, resulting in elevated privileges. With elevated privileges, the attacker can create or modify administrator accounts, dump credentials, disable protections, install persistence, access sensitive files, and move laterally to other systems. Because exploit maturity is listed as none and no KEV activity is identified, defenders should treat exploitation as plausible but not currently evidenced by widely reported exploitation from the provided data.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-32091 for all affected Windows versions, including Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 23H2, 24H2, 25H2, and 26H1; Windows Server 2016, 2019, 2022, 2022 23H2, and 2025. Because no exact fixed build numbers were provided, use the Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or equivalent patch-management tooling to identify the applicable cumulative update for each OS release and ensure superseding updates are installed. Reboot systems where required, because Windows kernel and file-system component fixes commonly require restart to become active. If immediate patching is not possible, reduce risk by limiting local interactive access, restricting RDP and remote management exposure, enforcing least privilege, applying application control such as Windows Defender Application Control or AppLocker, enabling tamper protection and EDR, and monitoring for local privilege-escalation behavior. Mitigations should be considered temporary; patching is the reliable fix.

How to confirm the fix worked

Confirm that affected Windows clients and servers have installed the Microsoft cumulative/security update that includes the fix, using Windows Update history, WSUS/SCCM/Intune compliance data, vulnerability scanner results, or direct build/KB inventory mapped against the Microsoft Security Update Guide. Validate that systems have rebooted after installation where required. Run authenticated vulnerability scans against representative Windows 10, Windows 11, and Windows Server assets to verify the vulnerability is no longer reported. For manual validation, compare OS edition and build against the fixed or superseding update baseline published by Microsoft for the relevant release channel. Also confirm that unsupported or out-of-servicing Windows releases are upgraded to supported versions receiving security updates.

Typical attack path

1. Gain initial local code execution on an affected Windows endpoint or server.
2. Run a local privilege-escalation exploit targeting the Microsoft Brokering File System race condition.
3. Repeatedly trigger the vulnerable operation to win the race window.
4. Obtain elevated privileges, commonly administrator or SYSTEM-equivalent control depending on exploit behavior.
5. Disable or evade local security controls, collect credentials, or install persistence.
6. Use the elevated host access for lateral movement, data access, ransomware staging, or further compromise.

How to detect it

There are no unique public exploit indicators in the provided data, so detection should focus on evidence of local privilege escalation and post-exploitation on affected Windows hosts. Review Windows Security logs for suspicious sequences where a non-admin or unexpected process is followed by special privilege assignment, administrator-level process execution, new service creation, scheduled task creation, credential dumping attempts, or security control changes. Useful Windows events include 4688 for process creation, 4672 for special privileges assigned to a new logon, 4624 for local or remote logons, 4720/4728/4732 for user and group changes, 4697 and System 7045 for service installation, 4698 for scheduled task creation, 1102 for audit log clearing, and Defender/EDR alerts for tampering or credential access. If Sysmon is deployed, review Event ID 1 for suspicious process execution, Event ID 7 for unusual driver/module loads, Event ID 10 for LSASS access, Event ID 11 for unusual file writes in privileged paths, Event ID 12/13/14 for persistence-related registry changes, and Event ID 15 for alternate data stream usage. Hunt for a low-privilege process spawning high-integrity shells or administrative tools without a normal UAC/admin workflow. Also correlate any suspected privilege escalation with later activity such as credential dumping, lateral movement, remote service creation, PowerShell abuse, security product disablement, or ransomware staging. Because this is a race-condition local EoP, absence of a specific signature does not rule out exploitation; rely on behavioral correlation and endpoint forensics.

What your security team should do

• Prioritize patching internet-managed, high-value, shared, and administrator-used Windows systems first, followed by broad workstation and server coverage.
• Use centralized patch tooling to identify all affected Windows 10, Windows 11, and Windows Server versions and track compliance to a fixed cumulative update baseline.
• Because the vulnerability has been public for 120 days, treat persistent unpatched systems as elevated risk even though EPSS is currently low and no KEV listing is present.
• Harden local privilege-escalation paths by enforcing least privilege, removing unnecessary local administrators, restricting interactive logon, and limiting RDP/remote management access.
• Enable and review process creation, service creation, privilege assignment, and security-control tampering telemetry on Windows endpoints.
• Investigate suspicious post-exploitation behavior such as unexpected administrator account creation, LSASS access, security tool disablement, new services, scheduled tasks, or privilege changes.
• Do not rely on network perimeter controls alone; this is a local privilege-escalation issue that becomes critical after any initial endpoint compromise.