Windows 11 24H2: 661 Flaws Fixed in November 2026 — Kernel, LSASS, DHCP Client and Other SYSTEM-Level Bugs Explained

Cyber · 2026-11-10 · By H.A

Microsoft's November update fixes 661 vulnerabilities in Windows 11 24H2, including 33 Critical, plus kernel, LSASS and DHCP Client privilege-escalation flaws that turn a foothold into SYSTEM; install KB5132061 and reboot.

What happened

Microsoft's November 2026 Patch Tuesday, released on 10 November, fixes 661 vulnerabilities that affect Windows 11 version 24H2, the most widely deployed Windows 11 release. 33 of them are rated Critical and the rest Important.

Tonight the Reef Sentinel CVE feed shows eight entries titled "Microsoft Windows 11 Version 24H2", including CVE-2026-96129, CVE-2026-96115, CVE-2026-96016 and CVE-2026-95976. This article explains what each of them is, and what the full 24H2 update fixes.

None of the eight is publicly disclosed or exploited in the wild. Seven of them let an attacker who already has a foothold on a PC become SYSTEM, the highest privilege on Windows.

The 24H2 CVEs in the feed

CVE-2026-96016 — LSASS elevation of privilege (CVSS 7.8). A heap-based buffer overflow in the Local Security Authority Subsystem Service, the process that handles logons and holds credentials in memory. A logged-on attacker can gain SYSTEM. Also affects Windows Server 2022 and 2025. Microsoft rates it "Exploitation Less Likely".

CVE-2026-96129 — Windows Kernel elevation of privilege (CVSS 7.8). "Inclusion of functionality from an untrusted control sphere" in the kernel: the kernel can be made to use code or data it should not trust. A local attacker can gain SYSTEM. Rated "Exploitation Unlikely".

CVE-2026-95988 — Windows Kernel elevation of privilege (CVSS 7.8). Incorrect authorization in the kernel lets a local attacker reach protected resources from a restricted process running as SYSTEM. The only one of the eight that Microsoft rates "Exploitation More Likely", so it deserves attention first.

CVE-2026-96115 — Windows DHCP Client elevation of privilege (CVSS 8.0). A double free in the DHCP Client, the service that gets a PC's IP address from the network. Unlike the others, this one is reachable from the adjacent network: an attacker on the same LAN or Wi-Fi, with low privileges, could gain SYSTEM. Also affects Windows Server 2025. It has the highest score of the eight.

CVE-2026-95976 — Windows Diagnostic Policy Service elevation of privilege (CVSS 7.0). A race condition (with use-after-free) in the Diagnostic Policy Service. The attacker has to win a timing race, which makes the attack harder, but success gives SYSTEM. Also affects Windows Server 2025.

CVE-2026-95979 and CVE-2026-96097 — Windows Brokering File System elevation of privilege (CVSS 7.0 each). Two memory-safety bugs (use-after-free, and release of an invalid pointer) in the Brokering File System. Both are hard to trigger: one needs a race to be won, the other needs a memory allocation to fail at just the right moment. Both lead to SYSTEM.

CVE-2026-96137 — Windows Graphics Kernel information disclosure (CVSS 5.5). A local attacker can read small portions of heap memory. On its own it only leaks data, but leaks like this are often used to defeat memory protections in an exploit chain.

Why "local" bugs still matter

Most of these need the attacker to already be running code on the PC, through a phishing attachment, a malicious download or a stolen low-privilege account. That is exactly how real intrusions work. Privilege escalation is step two: it turns a normal user's session into SYSTEM, which lets an attacker switch off security tools, dump credentials from LSASS and move to other machines. Ransomware crews routinely chain a remote foothold with a local privilege escalation like these.

The bigger 24H2 picture

The eight feed entries are a small slice. Across the whole release, 661 CVEs affect Windows 11 24H2:

• 448 elevation of privilege
• 82 remote code execution
• 77 information disclosure
• 31 denial of service
• 10 security feature bypass, 10 tampering, 3 spoofing

The 33 Critical fixes for 24H2 include the Windows Search, LDAP, Xbox Live Networking Service, TCP/IP, SMB server (srvnet.sys), Schannel, CredSSP, RPC Runtime and Message Queuing remote code execution flaws, plus several Hyper-V and Graphics Kernel privilege escalations.

The fix

All of these are fixed in the November 2026 cumulative update for Windows 11:

• KB5132061 covers Windows 11 24H2, 25H2 and 26H2 (Microsoft also lists KB5132043 for the same versions)
• KB5132059 covers Windows 11 26H1
• Windows Server 2025 gets KB5131080 (hotpatch KB5131077), and Windows Server 2022 gets KB5131090 for the LSASS flaw

One cumulative update fixes all 661: there is nothing to install per CVE.

What to do

1. Install the November cumulative update on every Windows 11 24H2 PC: Settings → Windows Update → Check for updates, or deploy through Intune, WSUS or your patch tool.
2. Restart. The kernel, LSASS and DHCP Client fixes only take effect after a reboot.
3. Prioritise shared and exposed machines: laptops that join public or hotel Wi-Fi (DHCP Client flaw), shared workstations and Remote Desktop hosts.
4. Turn on LSA protection (RunAsPPL) and Credential Guard where possible, so LSASS is harder to abuse even before patching.
5. Remove local admin rights from everyday accounts. Privilege escalation bugs matter most where users already run untrusted code.

Bottom line

Nothing in this set is under attack today, and none of the eight feed entries is Critical on its own. But they are exactly the privilege-escalation bugs that turn a phishing click into full control of a PC. One cumulative update fixes all 661 Windows 11 24H2 flaws, so install it and reboot this week.