PatchaPalooza

CVE-2026-32076: Windows Storage Spaces Controller Elevation of Privilege Vulnerability

CVE-2026-32076 is an elevation of privilege vulnerability in Windows Storage Spaces Controller, rated Important by Microsoft, with a CVSS 3.1 base score of 7.8 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.26% probability of exploitation activity in the next 30 days, higher than 18% of all scored vulnerabilities. Microsoft released the fix on 14 April 2026 in the April 2026 Patch Tuesday, delivered through 5 security updates (KB5082063, KB5083769, KB5082052, KB5082060 and more). It affects 11 products in 1 product family (Windows).

Key facts

CVE ID
CVE-2026-32076
Severity
High CVSS 7.8
Microsoft severity
Important
Impact
Elevation of Privilege
Exploited in the wild
No
Publicly disclosed
No
Exploitation likelihood
Less Likely
Weakness
CWE-125
EPSS
0.26% (percentile 18%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
April 2026 Patch Tuesday
Product families
Windows

CVSS score and vector

Microsoft scores CVE-2026-32076 at 7.8 (temporal 6.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

MetricValue
Attack vectorLocal
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit code maturityUnproven
Remediation levelOfficial fix
Report confidenceConfirmed

Description

Out-of-bounds read in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

Frequently asked questions (Microsoft)

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Affected products (11)

Windows

ProductSecurity updateTypeFixed buildRestart
Windows Server 2025 (Server Core installation)KB5082063Security Update10.0.26100.32690Yes
Windows 11 Version 25H2 for ARM64-based SystemsKB5083769Security Update10.0.26200.8246Yes
Windows 11 Version 25H2 for x64-based SystemsKB5083769Security Update10.0.26200.8246Yes
Windows 11 Version 23H2 for ARM64-based SystemsKB5082052Security Update10.0.22631.6936Yes
Windows 11 Version 23H2 for x64-based SystemsKB5082052Security Update10.0.22631.6936Yes
Windows Server 2022, 23H2 Edition (Server Core installation)KB5082060Security Update10.0.25398.2274Yes
Windows 11 Version 24H2 for ARM64-based Systems
Windows 11 Version 24H2 for x64-based Systems
Windows Server 2025KB5082063Security Update10.0.26100.32690Yes
Windows 11 Version 26H1 for ARM64-based SystemsKB5083768Security Update10.0.28000.1836Yes
Windows 11 version 26H1 for x64-based SystemsKB5083768Security Update10.0.28000.1836Yes

Security updates (5)

NIST NVD data

NVD status
Analyzed
NVD CVSS
7.8 (HIGH)
NVD weakness
CWE-125
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
windows 11 23h2 (arm64)before 10.0.22631.6936
windows 11 23h2 (x64)before 10.0.22631.6936
windows 11 24h2 (arm64)before 10.0.26100.8246
windows 11 24h2 (x64)before 10.0.26100.8246
windows 11 25h2 (arm64)before 10.0.26200.8246
windows 11 25h2 (x64)before 10.0.26200.8246
windows 11 26h1 (arm64)before 10.0.28000.1836
windows 11 26h1 (x64)before 10.0.28000.1836
windows server 2022 23h2before 10.0.25398.2274
windows server 2025before 10.0.26100.32690

References

Acknowledgments

  • Yoon Jung Hyun(Yuil Muil (@YuilMuil) / X)
  • Yoon Jung Hyun(Yuil Muil (@YuilMuil) / X)

Revision history

VersionDateDescription
1.0Information published.

Sources