{"id":"CVE-2026-113814","kind":"vulnerability","aliases":["CVE-2026-113814"],"related":[],"title":"Windows Storage Spaces Controller: untrusted pointer lets attacker run code remotely","description":"Untrusted pointer dereference in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network.","summary":"A flaw in the Windows Storage Spaces Controller lets an untrusted pointer be dereferenced. An unauthorized attacker over the network can execute code on the affected Windows machine.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","patch-tuesday","storage-spaces","windows","windows-11","windows-server-2025"],"not_affected_if":["patched"],"how_to_check":"Run winver or [Environment]::OSVersion / (Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').UBR and compare the full build with the fixed builds in the fix field. Whether Storage Spaces must be configured for exposure is not stated in the sources read; unknown.","fix":"Install the November 2026 Patch Tuesday cumulative update: Windows 11 23H2 build 10.0.22631.7711 or later; 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Windows Server 2025 10.0.26100.33822 (per the CNA record on NVD; KB numbers not confirmed per build).","status":"open","published_at":"2026-11-10T19:18:59+00:00","first_seen_at":"2026-11-10T19:24:41+00:00","triaged_at":"2026-11-10T19:31:47+00:00","updated_at":"2026-11-10T23:52:25+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:31:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Storage Spaces Controller: untrusted pointer lets attacker run code remotely","impact":"high","summary":"A flaw in the Windows Storage Spaces Controller lets an untrusted pointer be dereferenced. An unauthorized attacker over the network can execute code on the affected Windows machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","storage-spaces"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the Windows machine over the network","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds, the fixed update, and whether Storage Spaces must be in use.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000634,"input_tokens":4500,"output_tokens":367,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds, the fixed update, and whether Storage Spaces must be in use.","search":"'-11':45B '-113814':14A,17A '-2026':13A,16A '11':19A,22A,25A,28A,31A '2025':35A,49B '23h2':20A '24h2':23A '25h2':26A '26h1':29A '26h2':32A 'affect':75B 'allow':86C 'attack':8A,66B,89C 'code':10A,72B,92C 'control':4A,57B,85C 'cve':12A,15A 'derefer':80C 'dereferenc':63B 'execut':71B,91C 'flaw':51B 'infrastructur':36B 'let':7A,58B 'machin':77B 'network':69B,95C 'patch':38B 'patch-tuesday':37B 'pointer':6A,61B,79C 'remot':11A 'run':9A 'server':34A,48B 'space':3A,42B,56B,84C 'storag':2A,41B,55B,83C 'storage-spac':40B 'tuesday':39B 'unauthor':65B,88C 'untrust':5A,60B,78C 'window':1A,43B,44B,47B,54B,76B,82C 'windows':18A,21A,24A,27A,30A,33A 'windows-serv':46B","nicknames":[],"mitigations":[],"who_affected":"Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 (including Server Core) below the November 2026 builds are listed as affected by Microsoft's CNA record. The description says a network attacker needs no privileges, but the CVSS vector includes user interaction. Whether Storage Spaces must be in use is not stated in the sources read. Machines already on the fixed builds can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1123h2","1124h2","1125h2","1126h1","1126h2","server2025","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2025"],"ptokens":["11","2025","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","patchtuesday","storagespaces","windows","windows11","windowsserver2025"],"campaign_type":null,"search_a":"'-113814':14A,17A '-2026':13A,16A '11':19A,22A,25A,28A,31A '2025':35A '23h2':20A '24h2':23A '25h2':26A '26h1':29A '26h2':32A 'attack':8A 'code':10A 'control':4A 'cve':12A,15A 'let':7A 'pointer':6A 'remot':11A 'run':9A 'server':34A 'space':3A 'storag':2A 'untrust':5A 'window':1A 'windows':18A,21A,24A,27A,30A,33A","search_b":"'-11':45B '2025':49B 'affect':75B 'attack':66B 'code':72B 'control':57B 'dereferenc':63B 'execut':71B 'flaw':51B 'infrastructur':36B 'let':58B 'machin':77B 'network':69B 'patch':38B 'patch-tuesday':37B 'pointer':61B 'server':48B 'space':42B,56B 'storag':41B,55B 'storage-spac':40B 'tuesday':39B 'unauthor':65B 'untrust':60B 'window':43B,44B,47B,54B,76B 'windows-serv':46B","search_c":"'allow':86C 'attack':89C 'code':92C 'control':85C 'derefer':80C 'execut':91C 'network':95C 'pointer':79C 'space':84C 'storag':83C 'unauthor':88C 'untrust':78C 'window':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:33:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113814","severity":null,"published_at":"2026-11-10T19:18:59+00:00","modified_at":"2026-11-10T19:19:00+00:00","first_seen_at":"2026-11-10T19:24:41+00:00","fetched_at":"2026-11-10T19:24:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113814:3246","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113814","severity":null,"published_at":"2026-11-10T23:52:25+00:00","modified_at":"2026-11-10T23:52:25+00:00","first_seen_at":"2026-11-10T23:52:25+00:00","fetched_at":"2026-11-10T23:52:25+00:00","note":"Affected builds and fixed builds from the NVD page carrying Microsoft's CNA data. The MSRC guide is JS-only and unreachable, so nothing is verified. No exploitation or PoC found (not in KEV per Rapid7). Whether Storage Spaces must be in use is unknown. X not searched.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-113814"]}],"documents":[{"id":120477,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113814","title":"NVD CVE-2026-113814 (CNA data from Microsoft)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":117150,"url":"https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5132061-and-kb5131087-cumulative-updates-released/","title":"Windows 11 KB5132061 & KB5131087 cumulative updates released","kind":"blog","source":"blog","publisher":null,"text":"Windows 11 KB5132061 & KB5131087 cumulative updates released\n\nMicrosoft has released the Patch Tuesday Windows 11 and cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs, and add new features. [...]","published_at":"2026-11-10T18:33:26+00:00","relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}