Affected Microsoft products: Windows Server 2019, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019 (Server Core installation), Windows 10 Version 1809 for 32-bit

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 13, 2026 · CIRCL Vulnerability Lookup

   Detected

   Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

2. Oct 14, 2026 · CIRCL Vulnerability Lookup

   Updated

   Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

3. Oct 15, 2026 · NIST NVD

   Updated

   Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

4. Oct 16, 2026 · NIST NVD

   Updated

   Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

Affected

• microsoft Windows 10 Version 1809 for 32-bit Systemsversion unspecified
• microsoft Windows 10 Version 1809 for x64-based Systemsversion unspecified
• microsoft Windows Server 2019version unspecified
• microsoft Windows Server 2019 (Server Core installation)version unspecified
• vendor Microsoft Windows 10 Version 1809version unspecified
• vendor Microsoft Windows Server 2019version unspecified
• vendor Microsoft Windows Server 2019 (Server Core installation)version unspecified

Sources

• CIRCL Vulnerability LookupVulnerability recordCVE-2026-108471

  Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

  vulnerability.circl.lu
• CVE.orgVulnerability recordCVE-2026-108471

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-108471

  30-day exploitation probability 0.3%

  first.org
• Microsoft Security Update GuideVendor advisoryCVE-2026-108471

  Windows Server 2019, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019 (Server Core installation), Windows 10 Version 1809 for 32-bit Systems

  msrc.microsoft.com
• NIST NVDVulnerability recordCVE-2026-108471

  Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

  nvd.nist.gov

References

• Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulne · msrc.microsoft.com