{"id":"CVE-2026-122475","kind":"vulnerability","aliases":["CVE-2026-122475"],"related":[],"title":"Windows Storage Spaces Controller: pointer flaw lets a network attacker run code","description":"Untrusted pointer dereference in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network.","summary":"Untrusted pointer dereference (CWE-822) in Windows Storage Spaces Controller lets an unauthenticated attacker execute code over the network. Microsoft rates it CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) and the record shows no exploitation (E:U, not in CISA KEV). Fixed in the November 2026 Windows updates.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","rce","storage-spaces","windows","windows-server"],"not_affected_if":[],"how_to_check":"Run winver or [System.Environment]::OSVersion in PowerShell and compare the build (10.0.x.y) with the fixed builds listed in the fix. Anything lower is exposed. Default state of the component and whether Storage Spaces needs to be in use are unknown until the MSRC page is read.","fix":"Install the November 2026 Windows cumulative update: Windows 11 23H2 10.0.22631.7711, 24H2 10.0.26100.9974, 25H2 10.0.26200.9974, 26H1 10.0.28000.3501, 26H2 10.0.26300.9974, Windows Server 2025 10.0.26100.33822.","status":"open","published_at":"2026-11-10T19:20:37+00:00","first_seen_at":"2026-11-10T19:25:11+00:00","triaged_at":"2026-11-10T19:27:43+00:00","updated_at":"2026-11-10T21:37:45+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:27:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Storage Spaces Controller: pointer flaw lets a network attacker run code","impact":"high","summary":"Windows Storage Spaces Controller mishandles an untrusted pointer, letting an unauthorized attacker run code on the machine over the network. The sources rate it high, CVSS 8.8, and do not describe exploitation in the wild.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","storage-spaces"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the Windows server over the network","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-122475 to get affected builds, the fixed update and the component's default state.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows systems that run the Storage Spaces Controller component, which handles storage pool management. The sources do not name affected Windows builds or whether the component is enabled by default. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":4500,"output_tokens":430,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-122475 to get affected builds, the fixed update and the component's default state.","search":"'-122475':15A,18A '-2026':14A,17A '-822':50B '11':20A,23A,26A,29A,32A '2025':36A '2026':91B '23h2':21A '24h2':24A '25h2':27A '26h1':30A '26h2':33A '8.8':69B 'allow':102C 'attack':10A,59B,105C 'av':70B 'cisa':85B 'code':12A,61B,108C 'control':4A,55B,101C 'cve':13A,16A 'cvss':68B 'cwe':49B 'derefer':48B,96C 'e':81B 'execut':60B,107C 'exploit':80B 'fix':87B 'flaw':6A 'infrastructur':37B 'kev':86B 'l/pr':72B 'let':7A,56B 'microsoft':65B 'n/ac':71B 'n/ui':73B 'network':9A,64B,111C 'novemb':90B 'pointer':5A,47B,95C 'r':74B 'rate':66B 'rce':38B 'record':77B 'run':11A 'server':35A,45B 'show':78B 'space':3A,41B,54B,100C 'storag':2A,40B,53B,99C 'storage-spac':39B 'u':82B 'unauthent':58B 'unauthor':104C 'untrust':46B,94C 'updat':93B 'window':1A,42B,44B,52B,92B,98C 'windows':19A,22A,25A,28A,31A,34A 'windows-serv':43B","nicknames":[],"mitigations":[],"who_affected":"Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 (including Server Core) below the fixed builds, per the CVE record. Servers and PCs reachable over the network are the priority; Windows 10 and older Servers are not listed in this record.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["1123h2","1124h2","1125h2","1126h1","1126h2","server2025","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2025"],"ptokens":["11","2025","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","rce","storagespaces","windows","windowsserver"],"campaign_type":null,"search_a":"'-122475':15A,18A '-2026':14A,17A '11':20A,23A,26A,29A,32A '2025':36A '23h2':21A '24h2':24A '25h2':27A '26h1':30A '26h2':33A 'attack':10A 'code':12A 'control':4A 'cve':13A,16A 'flaw':6A 'let':7A 'network':9A 'pointer':5A 'run':11A 'server':35A 'space':3A 'storag':2A 'window':1A 'windows':19A,22A,25A,28A,31A,34A","search_b":"'-822':50B '2026':91B '8.8':69B 'attack':59B 'av':70B 'cisa':85B 'code':61B 'control':55B 'cvss':68B 'cwe':49B 'derefer':48B 'e':81B 'execut':60B 'exploit':80B 'fix':87B 'infrastructur':37B 'kev':86B 'l/pr':72B 'let':56B 'microsoft':65B 'n/ac':71B 'n/ui':73B 'network':64B 'novemb':90B 'pointer':47B 'r':74B 'rate':66B 'rce':38B 'record':77B 'server':45B 'show':78B 'space':41B,54B 'storag':40B,53B 'storage-spac':39B 'u':82B 'unauthent':58B 'untrust':46B 'updat':93B 'window':42B,44B,52B,92B 'windows-serv':43B","search_c":"'allow':102C 'attack':105C 'code':108C 'control':101C 'derefer':96C 'execut':107C 'network':111C 'pointer':95C 'space':100C 'storag':99C 'unauthor':104C 'untrust':94C 'window':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122475","severity":null,"published_at":"2026-11-10T19:20:37+00:00","modified_at":"2026-11-10T19:20:37+00:00","first_seen_at":"2026-11-10T19:25:11+00:00","fetched_at":"2026-11-10T19:25:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122475:2824","url":"https://app.opencve.io/cve/CVE-2026-122475","severity":null,"published_at":"2026-11-10T21:37:45+00:00","modified_at":"2026-11-10T21:37:45+00:00","first_seen_at":"2026-11-10T21:37:45+00:00","fetched_at":"2026-11-10T21:37:45+00:00","note":"MSRC page is JS-only and unreadable; versions come from OpenCVE mirror of Microsoft's CNA record (not primary page), so nothing marked verified. Not in KEV, no exploitation or PoC found.","cites":["https://app.opencve.io/cve/CVE-2026-122475"]}],"documents":[{"id":118946,"url":"https://app.opencve.io/cve/CVE-2026-122475","title":"OpenCVE: CVE-2026-122475 (mirror of Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}