If you’re sorting the November Windows rollout by privilege-escalation risk, move CVE-2026-119398 up the queue. The November 11, 2026 MSRC feed raised its CVSS 3.1 score from 7.0 to 7.8. Microsoft originally published it on November 10.
What changed
Microsoft’s current score uses Low attack complexity. The same advisory’s FAQ still says High and describes a local, authenticated attacker, a specific type of system-wide installer package and an uninstall operation. Treat the prerequisites as documented while Microsoft reconciles the score and FAQ. Successful exploitation can give the attacker SYSTEM privileges.
Vendor rating Important. Microsoft reports no known exploitation or public disclosure and assesses exploitation More Likely. CISA KEV has no matching entry. Suggested MSP priority Prioritize exposed multi-user endpoints and technician jump hosts with patch drift, then other affected Windows systems. Last verified November 12, 2026 UTC.
November cumulative updates
The MSRC matrix lists these affected Windows releases and current November builds, including the listed Server Core editions. Verify edition and servicing eligibility for older branches. The advisory does not provide complete lower build boundaries.
| Affected release | November KB and OS build |
|---|---|
| Windows 10 1607 / Server 2016 | KB5131291 · 14393.9688 |
| Windows 10 1809 / Server 2019 | KB5131085 · 17763.9487 |
| Windows 10 21H2 / 22H2 | KB5131096 · 19044.7846 / 19045.7846 |
| Server 2022 | KB5131090 · 20348.5870 |
| Windows 11 23H2 | KB5131087 · 22631.7711 |
| Windows 11 24H2 / 25H2 / 26H2 | KB5132061 · 26100.9974 / 26200.9974 / 26300.9974 |
| Windows 11 26H1 | KB5132059 · 28000.3501 |
| Server 2025 | KB5131080 · 26100.33822 |
Inventory Windows release and running build per customer. Roll out the applicable cumulative update, reboot as required and confirm the installed KB and build after restart. The patch mapping is unchanged. No vendor workaround or mandatory compromise check was verified.
Microsoft advisory · MSRC November CVRF · Microsoft Update Catalog · CISA KEV