Windows Search CVE-2026-116928: CVSS 9.8 RCE with no credentials and no clicks
November 2026 Windows updates fix a network-reachable out-of-bounds write in the Search component

Windows Search CVE-2026-116928: CVSS 9.8 RCE with no credentials and no clicks

Buried in a 1,094-CVE Patch Tuesday is the highest-scoring bug of the month: a Windows Search component that can be made to execute code over the network by an attacker with no account and no help from the user.

What happened

CVE-2026-116928 is an out-of-bounds write in the Microsoft Windows Search component, patched on 10 November. Microsoft scores it 9.8 with an attack vector of network, low complexity, no privileges required and no user interaction. Confidentiality, integrity and availability are all rated high.

Exploit code maturity is listed as unproven and Microsoft has not recorded exploitation, so this is a patch-before-someone-writes-the-exploit problem, not a fire. The reason it deserves attention anyway is the shape of the bug: network reachable, pre-authentication, no clicks. That is the profile that turns into mass scanning the week a proof of concept appears.

Who is affected

Practically every supported Windows build, which means every SME estate that has not taken the November 2026 cumulative updates.

  • Windows Server 2016, 2019, 2022 and 2025, including Server Core installs
  • Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2
  • Windows 10 1607 and 22H2, including LTSC-era builds still in support

Servers matter more than desktops here: a searchable file server or an RDP host that also runs the indexing service is a far better target than a laptop, and it is usually reachable from more of the network.

What to do now

Apply the November 2026 cumulative update to every Windows Server first, then to workstations, and confirm the build number rather than trusting the patch dashboard.

  • Patch internet-facing and RDP-exposed servers within the week; this bug needs no login to reach.
  • Confirm the search service is not listening beyond the segments that need it. If the Windows Search index has no business being reachable from a guest VLAN or a VPN pool, close it.
  • Check that the update actually installed on machines that have been offline, and on hypervisor templates that new VMs are cloned from.
  • Watch for scanning against SMB and RPC ports from unusual sources as an early warning; a working exploit will be preceded by probing.

What this means for South African businesses

Local SMEs rarely have a patching cadence tight enough to absorb a 1,094-CVE month, and the tendency is to triage by severity label and let the rest ride. The Outlook zero-day in the same release will get the attention; this one will not, even though its score is three points higher.

My judgement is that the practical risk for a small business sits with the one or two Windows Servers nobody reboots, not with the fleet of laptops, so a manual check of server patch levels this week is worth more than a plan to improve patching next quarter. It is also a reminder that a 9.8 with no exploitation is still a 9.8.

Source: Microsoft Security Update Guide, CVE-2026-116928, published 10 November 2026.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

Microsoft Outlook CVE-2026-124194: opening a message file hands over your NTLMv2 hash
Patch the November 2026 Outlook update now, the flaw is already exploited