---
id: "CVE-2026-121680"
page: "https://infrastack.ai/live/CVE-2026-121680"
kind: "vulnerability"
aliases: ["CVE-2026-121680"]
title: "Windows NTLM: information exposure lets an attacker spoof over the network"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Windows 10 1607 / Server 2016", "fixed": ["10.0.14393.9688"], "affected": "< 10.0.14393.9688", "ecosystem": "vendor"}, {"name": "Windows 10 1809 / Server 2019", "fixed": ["10.0.17763.9487"], "affected": "< 10.0.17763.9487", "ecosystem": "vendor"}, {"name": "Windows 10 21H2", "fixed": ["10.0.19044.7846"], "affected": "< 10.0.19044.7846", "ecosystem": "vendor"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": "< 10.0.19045.7846", "ecosystem": "vendor"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": "< 10.0.22631.7711", "ecosystem": "vendor"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": "< 10.0.26100.9974", "ecosystem": "vendor"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9974"], "affected": "< 10.0.26200.9974", "ecosystem": "vendor"}, {"name": "Windows 11 26H1", "fixed": ["10.0.28000.3501"], "affected": "< 10.0.28000.3501", "ecosystem": "vendor"}, {"name": "Windows 11 26H2", "fixed": ["10.0.26300.9974"], "affected": "< 10.0.26300.9974", "ecosystem": "vendor"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": "< 10.0.20348.5870", "ecosystem": "vendor"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": "< 10.0.26100.33822", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["active-directory", "network-reachable", "ntlm", "other", "title-review", "unauthenticated", "windows"]
not_affected_if: ["patched-build"]
published_at: "2026-11-10T19:20:31+00:00"
first_seen_at: "2026-11-10T19:25:09+00:00"
updated_at: "2026-11-10T21:45:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121680", "first_seen_at": "2026-11-10T19:25:09+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/cve-2026-121680", "first_seen_at": "2026-11-10T21:45:13+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/cve-2026-121680", "https://cve.imfht.com/detail/CVE-2026-121680"]}]
exploit_sources: []
---

# Windows NTLM: information exposure lets an attacker spoof over the network

Link for people: https://infrastack.ai/live/CVE-2026-121680 (this .md is for agents)

Microsoft's November 2026 update fixes an NTLM flaw (CWE-522, CVSS 7.5: network, no authentication, no user interaction, high confidentiality impact). It exposes sensitive information to an unauthorized actor and allows spoofing over a network. Microsoft's text does not say what leaks. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows 10 1607 / Server 2016 affected < 10.0.14393.9688 fixed 10.0.14393.9688
- vendor:Windows 10 1809 / Server 2019 affected < 10.0.17763.9487 fixed 10.0.17763.9487
- vendor:Windows 10 21H2 affected < 10.0.19044.7846 fixed 10.0.19044.7846
- vendor:Windows 10 22H2 affected < 10.0.19045.7846 fixed 10.0.19045.7846
- vendor:Windows 11 23H2 affected < 10.0.22631.7711 fixed 10.0.22631.7711
- vendor:Windows 11 24H2 affected < 10.0.26100.9974 fixed 10.0.26100.9974
- vendor:Windows 11 25H2 affected < 10.0.26200.9974 fixed 10.0.26200.9974
- vendor:Windows 11 26H1 affected < 10.0.28000.3501 fixed 10.0.28000.3501
- vendor:Windows 11 26H2 affected < 10.0.26300.9974 fixed 10.0.26300.9974
- vendor:Windows Server 2022 affected < 10.0.20348.5870 fixed 10.0.20348.5870
- vendor:Windows Server 2025 affected < 10.0.26100.33822 fixed 10.0.26100.33822

## How to check

Compare the Windows build number (run winver, or [System.Environment]::OSVersion.Version in PowerShell) with the fixed builds in the product list. A build below the fixed one is affected. The KB number per build is in the MSRC Update Guide entry for CVE-2026-121680 (not read).

## Fix

Install the November 2026 Windows cumulative update that raises the build to at least the fixed build for your version (e.g. Windows 11 24H2 10.0.26100.9974, Server 2022 10.0.20348.5870). Check the KB number in MSRC.

## Timeline

- 2026-11-10T19:25:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121680
- 2026-11-10T21:45:13+00:00 analyst https://nvd.nist.gov/vuln/detail/cve-2026-121680 — MSRC page is JS-only and unreadable here; used NVD (Microsoft CNA data) and an aggregator for build thresholds. Nothing verified. No exploitation or PoC found. Exact KB numbers per build unconfirmed.

## Documents

- [describes] NVD CVE-2026-121680 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/cve-2026-121680
- [mentions] CVE-2026-121680 affected version matrix (aggregator) https://cve.imfht.com/detail/CVE-2026-121680

## From the sources

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_