{"id":"CVE-2026-108415","kind":"vulnerability","aliases":["CVE-2026-108415"],"related":[],"title":"Windows File Server Resource Management: physical attack lets an attacker gain privileges","description":"Untrusted pointer dereference in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges with a physical attack.","summary":"An untrusted pointer dereference in the Windows File Server Resource Management Service lets an attacker with physical access raise their privileges. The sources describe a physical attack path only.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows File Server Resource Management Service","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["file-server","infrastructure","windows"],"not_affected_if":["no-physical-access-risk"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:12+00:00","first_seen_at":"2026-11-10T19:24:23+00:00","triaged_at":"2026-11-10T19:55:50+00:00","updated_at":"2026-11-10T19:55:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:55:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows File Server Resource Management: physical attack lets an attacker gain privileges","impact":"medium","summary":"An untrusted pointer dereference in the Windows File Server Resource Management Service lets an attacker with physical access raise their privileges. The sources describe a physical attack path only.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","file-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker with physical access gains elevated privileges on the machine","analyst_note":"Check the NVD entry and Microsoft's advisory for CVE-2026-108415 to confirm affected Windows builds, fixed updates and whether the attack needs a logged-in account.","how_to_check":"- unknown","plain_action":"","product_name":"Windows File Server Resource Management Service","needs_analyst":true,"not_affected_if":["no-physical-access-risk"],"who_is_affected":"Organizations running Windows servers with the File Server Resource Management service enabled are the likely exposure, since the flaw is in that Windows component. Machines kept in locked, controlled locations face less risk from a physical attack. The sources do not say which Windows builds are affected.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000698,"input_tokens":4504,"output_tokens":496,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108415':15A,18A '-2026':14A,17A 'access':47B 'allow':68C 'attack':7A,10A,44B,56B,71C,78C 'cve':13A,16A 'derefer':33B,60C 'describ':53B 'elev':73C 'file':2A,20A,26B,37B,63C 'file-serv':25B 'gain':11A 'infrastructur':28B 'let':8A,42B 'manag':5A,40B,66C 'management':23A 'path':57B 'physic':6A,46B,55B,77C 'pointer':32B,59C 'privileg':12A,50B,74C 'rais':48B 'resourc':4A,39B,65C 'resource':22A 'server':3A,21A,27B,38B,64C 'servic':41B,67C 'service':24A 'sourc':52B 'unauthor':70C 'untrust':31B,58C 'window':1A,29B,36B,62C 'windows':19A","nicknames":[],"mitigations":[],"who_affected":"Organizations running Windows servers with the File Server Resource Management service enabled are the likely exposure, since the flaw is in that Windows component. Machines kept in locked, controlled locations face less risk from a physical attack. The sources do not say which Windows builds are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["fileserverresourcemanagementservice","windowsfileserverresourcemanagementservice"],"ptokens":["file","management","resource","server","service","windows"],"labels":["fileserver","infrastructure","medium","vendor","windows"],"campaign_type":null,"search_a":"'-108415':15A,18A '-2026':14A,17A 'attack':7A,10A 'cve':13A,16A 'file':2A,20A 'gain':11A 'let':8A 'manag':5A 'management':23A 'physic':6A 'privileg':12A 'resourc':4A 'resource':22A 'server':3A,21A 'service':24A 'window':1A 'windows':19A","search_b":"'access':47B 'attack':44B,56B 'derefer':33B 'describ':53B 'file':26B,37B 'file-serv':25B 'infrastructur':28B 'let':42B 'manag':40B 'path':57B 'physic':46B,55B 'pointer':32B 'privileg':50B 'rais':48B 'resourc':39B 'server':27B,38B 'servic':41B 'sourc':52B 'untrust':31B 'window':29B,36B","search_c":"'allow':68C 'attack':71C,78C 'derefer':60C 'elev':73C 'file':63C 'manag':66C 'physic':77C 'pointer':59C 'privileg':74C 'resourc':65C 'server':64C 'servic':67C 'unauthor':70C 'untrust':58C 'window':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108415","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108415","severity":null,"published_at":"2026-11-10T19:18:12+00:00","modified_at":"2026-11-10T19:18:12+00:00","first_seen_at":"2026-11-10T19:24:23+00:00","fetched_at":"2026-11-10T19:24:23+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}