If your November patch dashboard shows Windows Server 2025 as current, verify the actual build. Microsoft now classifies this Trace Data Helper issue as a local privilege escalation across the listed server and Windows 11 editions.
What changed
CVE-2026-121681 was originally published November 10. Microsoft’s CVE record was updated November 13 at 18:12 UTC. The November CVRF now classifies all ten platform entries as Important, Elevation of Privilege, replacing the prior Low and Defense in Depth labels. Microsoft publishes CVSS 3.1 7.8. The issue requires local access with low privileges and no user interaction. Microsoft reports no known exploitation or public disclosure and rates exploitation Less Likely. The CVE is absent from CISA KEV.
Affected builds and fixes
Microsoft lists x64 and Arm64 for each Windows 11 release, and x64 for Windows Server 2025. The version bounds below are for each named release.
| Product | Affected builds | Fixed build |
|---|---|---|
| Windows 11 24H2 | 26100.0 to below 26100.9711 | KB5127648, build 26100.9711 |
| Windows 11 25H2 | 26200.0 to below 26200.9711 | KB5127648, build 26200.9711 |
| Windows 11 26H2 | 26300.0 to below 26300.9711 | KB5127648, build 26300.9711 |
| Windows 11 26H1 | 28000.0 to below 28000.3231 | KB5127646, build 28000.3231 |
| Windows Server 2025, including Server Core | 26100.0 to below 26100.33822 | KB5131080, build 26100.33822 |
MSP rollout
Suggested MSP priority is expedited for systems below the fixed build, especially shared systems and privileged workstations. Inventory release, architecture and running build in the applicable management console. Apply the listed cumulative update or a supported superseding security update for the same servicing branch. Restart as required, verify the running build and confirm service health. If telemetry suggests an existing foothold, isolate and investigate under the customer’s incident-response process. No vendor workaround, compromise-check requirement or credential-rotation directive was verified.
Last verified November 14, 2026 UTC. MSRC advisory · MSRC November data · Microsoft’s CVE record · KB5127648 · KB5127646 · KB5131080 · CISA KEV data.