{"id":"CVE-2026-103571","kind":"vulnerability","aliases":["CVE-2026-103571"],"related":[],"title":"Windows: CNG Key Isolation service memory bug lets local attackers gain elevated privileges","description":"An elevation of privilege vulnerability exists when the Windows Cryptography Next Generation (CNG) Key Isolation service improperly handles memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context.\nTo exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.\nThe security update addresses the vulnerability by correcting how the Windows CNG Key Isolation Service handles memory.","summary":"Windows' Cryptography Next Generation (CNG) Key Isolation service mishandles memory, which allows an attacker to elevate privileges. An attacker must first run code on the machine and then launch a specially crafted application to run processes in an elevated context.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:17:41+00:00","first_seen_at":"2026-11-10T19:24:13+00:00","triaged_at":"2026-11-10T19:54:20+00:00","updated_at":"2026-11-10T19:54:20+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:54:20Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Windows: CNG Key Isolation service memory bug lets local attackers gain elevated privileges","impact":"high","summary":"Windows' Cryptography Next Generation (CNG) Key Isolation service mishandles memory, which allows an attacker to elevate privileges. An attacker must first run code on the machine and then launch a specially crafted application to run processes in an elevated context.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs processes with elevated privileges on the local machine","analyst_note":"Identify affected Windows builds and the Microsoft security update for CVE-2026-103571 from the MSRC advisory; the NVD record gives no product ranges or fix version.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Affects Windows systems where the CNG Key Isolation service is present. An attacker needs code execution on the machine first, so the exposure is to local users and malware already on a host. The sources do not list affected Windows builds, so teams should check their Windows update status against Microsoft's bulletin.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4625,"output_tokens":482,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Identify affected Windows builds and the Microsoft security update for CVE-2026-103571 from the MSRC advisory; the NVD record gives no product ranges or fix version.","search":"'-103571':16A,19A '-2026':15A,18A 'address':126C 'allow':33B 'applic':54B,119C 'attack':10A,35B,40B,82C,100C,112C 'bug':7A 'cng':2A,26B,74C,134C 'code':44B 'context':61B,94C 'correct':130C 'could':88C,113C 'craft':53B,118C 'cryptographi':23B,71C 'cve':14A,17A 'elev':12A,37B,60B,63C,93C,121C 'execut':106C 'exist':67C 'exploit':85C,96C 'first':42B,102C 'gain':11A,105C 'generat':25B,73C 'handl':79C,138C 'improp':78C 'infrastructur':20B 'isol':4A,28B,76C,136C 'key':3A,27B,75C,135C 'launch':50B 'let':8A 'local':9A 'machin':47B 'memori':6A,31B,80C,139C 'mishandl':30B 'must':41B 'next':24B,72C 'privileg':13A,38B,65C,122C 'process':57B,90C 'run':43B,56B,89C,115C 'secur':124C 'servic':5A,29B,77C,137C 'special':52B,117C 'success':84C 'system':110C 'updat':125C 'victim':109C 'vulner':66C,87C,98C,128C 'window':1A,21B,22B,70C,133C 'would':101C","nicknames":[],"mitigations":[],"who_affected":"Affects Windows systems where the CNG Key Isolation service is present. An attacker needs code execution on the machine first, so the exposure is to local users and malware already on a host. The sources do not list affected Windows builds, so teams should check their Windows update status against Microsoft's bulletin.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows"],"campaign_type":null,"search_a":"'-103571':16A,19A '-2026':15A,18A 'attack':10A 'bug':7A 'cng':2A 'cve':14A,17A 'elev':12A 'gain':11A 'isol':4A 'key':3A 'let':8A 'local':9A 'memori':6A 'privileg':13A 'servic':5A 'window':1A","search_b":"'allow':33B 'applic':54B 'attack':35B,40B 'cng':26B 'code':44B 'context':61B 'craft':53B 'cryptographi':23B 'elev':37B,60B 'first':42B 'generat':25B 'infrastructur':20B 'isol':28B 'key':27B 'launch':50B 'machin':47B 'memori':31B 'mishandl':30B 'must':41B 'next':24B 'privileg':38B 'process':57B 'run':43B,56B 'servic':29B 'special':52B 'window':21B,22B","search_c":"'address':126C 'applic':119C 'attack':82C,100C,112C 'cng':74C,134C 'context':94C 'correct':130C 'could':88C,113C 'craft':118C 'cryptographi':71C 'elev':63C,93C,121C 'execut':106C 'exist':67C 'exploit':85C,96C 'first':102C 'gain':105C 'generat':73C 'handl':79C,138C 'improp':78C 'isol':76C,136C 'key':75C,135C 'memori':80C,139C 'next':72C 'privileg':65C,122C 'process':90C 'run':89C,115C 'secur':124C 'servic':77C,137C 'special':117C 'success':84C 'system':110C 'updat':125C 'victim':109C 'vulner':66C,87C,98C,128C 'window':70C,133C 'would':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103571","severity":null,"published_at":"2026-11-10T19:17:41+00:00","modified_at":"2026-11-10T19:17:41+00:00","first_seen_at":"2026-11-10T19:24:13+00:00","fetched_at":"2026-11-10T19:24:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}