Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Windows ReFS Local Code Execution Risk with Authorized Access

CVE-2026-54109 · published 3 months ago
Summary

The Windows Resilient File System (ReFS) has a security issue that could allow someone with authorized access to run unauthorized code on the system. This is a concern because it could be used to gain control over the system or steal sensitive data. To protect your system, ensure that you keep Windows and ReFS up to date with the latest security patches.

What to do
  • Update microsoft windows 10 version 1607 to version 10.0.14393.9339 or later.
  • Update microsoft windows 10 version 1809 to version 10.0.17763.9020 or later.
  • Update microsoft windows 10 version 21h2 to version 10.0.19044.7548 or later.
  • Update microsoft windows 10 version 22h2 to version 10.0.19045.7548 or later.
  • Update microsoft windows 11 version 24h2 to version 10.0.26100.8875 or later.
  • Update microsoft windows 11 version 25h2 to version 10.0.26200.8875 or later.
  • Update microsoft windows server 2016 to version 10.0.14393.9339 or later.
  • Update microsoft windows server 2016 (server core installation) to version 10.0.14393.9339 or later.
  • Update microsoft windows server 2019 to version 10.0.17763.9020 or later.
  • Update microsoft windows server 2019 (server core installation) to version 10.0.17763.9020 or later.
  • Update microsoft windows server 2022 to version 10.0.20348.5386 or later.
  • Update microsoft windows server 2025 to version 10.0.26100.33158 or later.
  • Update microsoft windows server 2025 (server core installation) to version 10.0.26100.33158 or later.
  • Update microsoft windows_10_1607 to version 10.0.14393.9339 or later.
  • Update microsoft windows_10_1809 to version 10.0.17763.9020 or later.
  • Update microsoft windows_10_21h2 to version 10.0.19044.7548 or later.
  • Update microsoft windows_10_22h2 to version 10.0.19045.7548 or later.
  • Update microsoft windows_11_24h2 to version 10.0.26100.8875 or later.
  • Update microsoft windows_11_25h2 to version 10.0.26200.8875 or later.
  • Update microsoft windows_server_2016 to version 10.0.14393.9339 or later.
  • Update microsoft windows_server_2019 to version 10.0.17763.9020 or later.
  • Update microsoft windows_server_2022 to version 10.0.20348.5386 or later.
  • Update microsoft windows_server_2025 to version 10.0.26100.33158 or later.
Affected software
VendorProductAffected versions
microsoft windows 10 version 1607 < 10.0.14393.9339
microsoft windows 10 version 1809 < 10.0.17763.9020
microsoft windows 10 version 21h2 < 10.0.19044.7548
microsoft windows 10 version 22h2 < 10.0.19045.7548
microsoft windows 11 version 24h2 < 10.0.26100.8875
microsoft windows 11 version 25h2 < 10.0.26200.8875
microsoft windows 11 version 26h1 < 10.0.28000.2269
< 10.0.28000.2525
microsoft windows server 2016 < 10.0.14393.9339
microsoft windows server 2016 (server core installation) < 10.0.14393.9339
microsoft windows server 2019 < 10.0.17763.9020
microsoft windows server 2019 (server core installation) < 10.0.17763.9020
microsoft windows server 2022 < 10.0.20348.5386
microsoft windows server 2025 < 10.0.26100.33158
microsoft windows server 2025 (server core installation) < 10.0.26100.33158
microsoft windows_10_1607 < 10.0.14393.9339
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
microsoft windows_10_1809 < 10.0.17763.9020
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
microsoft windows_10_21h2 < 10.0.19044.7548
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*
microsoft windows_10_22h2 < 10.0.19045.7548
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*
microsoft windows_11_24h2 < 10.0.26100.8875
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*
microsoft windows_11_25h2 < 10.0.26200.8875
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*
microsoft windows_11_26h1 < 10.0.28000.2269
< 10.0.28000.2525
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*
microsoft windows_server_2016 < 10.0.14393.9339
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
microsoft windows_server_2019 < 10.0.17763.9020
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
microsoft windows_server_2022 < 10.0.20348.5386
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
microsoft windows_server_2025 < 10.0.26100.33158
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Original advisory text
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-190Integer Overflow
CWE-122Heap-based Buffer Overflow
Timeline
Published14 Jul 2026
Updated4 Nov 2026
First seen14 Jul 2026
Sources
CVE-2026-54109 · NVD
CVE-2026-54109 · MITRE
Track software like this
Free during beta