CVE-2026-41095

What it actually does

CVE-2026-41095 is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows Server Data Deduplication component. An attacker who already has local authenticated access can trigger unsafe reuse of freed memory in the deduplication functionality, potentially causing attacker-controlled code to execute with elevated privileges. Successful exploitation can result in high-impact compromise of confidentiality, integrity, and availability on the affected server, consistent with the CVSS 7.8 rating and local, low-complexity exploitation profile.

Why it matters to the business

A successful attack can allow a low-privileged user or malware already present on a Windows Server to gain administrative or system-level control. This can lead to data theft, tampering with stored files, disabling security controls, deployment of additional malware, lateral movement, and disruption of server workloads. The vulnerability affects multiple supported Windows Server generations, including Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025, so organizations with broad Windows Server estates should treat patch validation as important even though the current EPSS is low, no public exploit maturity is reported, and it is not listed in CISA KEV.

How an attack unfolds

An attacker first obtains low-privileged local access to an affected Windows Server, such as through stolen credentials, a compromised service account, interactive login, remote management access, or prior malware execution. The attacker then invokes functionality exposed by the Data Deduplication component in a way that triggers the use-after-free condition. By manipulating memory allocation and reuse around the vulnerable code path, the attacker attempts to redirect execution or corrupt privileged process state. If successful, the attacker elevates from a regular authenticated context to a higher-privileged context on the server, after which they can dump credentials, modify files, disable defenses, install persistence, or use the server as a foothold for lateral movement. There are currently no named threat actors, ransomware use, or known exploitation-in-the-wild signals provided for this vulnerability.

How to fix it

Apply the applicable Microsoft security updates for all affected Windows Server versions: Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. If a fixed build or KB is not available in asset tooling, use the latest cumulative update or security-only update from Microsoft for the relevant server release after the May 2026 security release. Prioritize systems where untrusted users can log in, systems with Data Deduplication installed or enabled, file servers, backup repositories, virtualization/storage hosts, and servers reachable through remote administration pathways. Where immediate patching is not possible, reduce exposure by removing or disabling Data Deduplication where not required, restricting local and remote interactive logon rights, limiting membership in privileged local groups, enforcing application control, and monitoring for suspicious local privilege escalation behavior.

How to confirm the fix worked

Confirm that each affected Windows Server has the relevant post-fix Microsoft security update installed using Windows Update, WSUS, Microsoft Configuration Manager, Intune, vulnerability management tools, or PowerShell inventory of installed hotfixes and OS build levels. Verify whether the Data Deduplication feature is installed using server role/feature inventory and prioritize validation on systems where it is enabled. Re-scan with an authenticated vulnerability scanner after patch deployment. Confirm that compensating controls are in place on unpatched systems, including restricted logon rights, least-privilege service accounts, endpoint protection, application control, and centralized logging. Because no fixed version list was supplied, validate against Microsoft’s official security update guide or your patch management catalog for the exact KB/build applicable to each Windows Server release.

Typical attack path

1. Gain local authenticated access to an affected Windows Server through credentials, malware, remote management, or another initial compromise path.
2. Determine whether the Data Deduplication feature/component is present or enabled and whether the host is missing the relevant security update.
3. Run a local exploit that interacts with Data Deduplication functionality to trigger the use-after-free condition.
4. Manipulate memory state to achieve execution or privileged action in an elevated context.
5. Use the elevated privileges to add accounts, dump credentials, disable security tools, install persistence, access sensitive data, or move laterally.

How to detect it

Review endpoint, Windows Security, Sysmon, EDR, and PowerShell logs for signs of local privilege escalation followed by administrative actions. Useful sources include Windows Security events for logon activity and privilege assignment, Service Control Manager events for new or modified services, scheduled task creation logs, PowerShell operational logs, Sysmon process/file/registry telemetry, Windows Defender or EDR alerts, and Data Deduplication operational logs if enabled. Look for low-privileged users spawning elevated shells, unexpected child processes from Data Deduplication-related services or PowerShell modules, abnormal execution of administrative tools immediately after local logon, new local administrator membership, LSASS access attempts, security control tampering, and lateral movement tools. Since no public exploit artifacts or named threat actor procedures are provided, detection should focus on behavioral evidence of local privilege escalation and post-exploitation rather than a CVE-specific exploit signature.

• Microsoft-Windows-Deduplication
• Deduplication
• ddpsvc
• Get-DedupStatus
• Get-DedupVolume
• Enable-DedupVolume
• Disable-DedupVolume
• Set-DedupVolume
• Start-DedupJob
• Stop-DedupJob
• Event ID 7045
• A service was installed in the system
• Event ID 4697
• A service was installed in the system
• Event ID 4698
• A scheduled task was created
• Event ID 4732
• A member was added to a security-enabled local group
• Event ID 4672
• Special privileges assigned to new logon
• Event ID 4688
• New Process Created
• Event ID 10
• ProcessAccess
• lsass.exe
• procdump.exe
• rundll32.exe comsvcs.dll, MiniDump
• reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• schtasks /create
• net localgroup administrators
• New-LocalUser
• Add-LocalGroupMember
• Set-MpPreference -DisableRealtimeMonitoring $true

What your security team should do

• Inventory Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025 systems and identify where Data Deduplication is installed or enabled.
• Prioritize patching for servers with local user access, remote administration exposure, file/storage roles, backup roles, or high-value workloads.
• Deploy the latest applicable Microsoft cumulative or security update and confirm installation through authenticated scanning and patch inventory.
• If patching is delayed, disable or remove Data Deduplication where not business-critical and restrict local/remote interactive logon to trusted administrators only.
• Harden against post-exploitation by enforcing least privilege, Credential Guard or equivalent protections where available, endpoint detection coverage, application control, and PowerShell logging.
• Monitor for suspicious privilege escalation behavior, including new local administrators, abnormal service creation, unexpected scheduled tasks, credential dumping activity, and security tool tampering.
• Track Microsoft advisories and exploit intelligence for changes in exploit maturity, EPSS movement, KEV listing, or weaponization by threat actors.