{"id":"CVE-2026-112793","kind":"vulnerability","aliases":["CVE-2026-112793"],"related":[],"title":"Windows Event Collector: use-after-free lets a network user gain higher privileges","description":"Use after free in Windows Event Collector Service allows an authorized attacker to elevate privileges over a network.","summary":"A use-after-free bug in the Windows Event Collector Service lets an attacker who already has an account on the network raise their privileges. The sources give no further detail on the trigger or the exact affected Windows builds.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-collector","infrastructure","windows","windows-server"],"not_affected_if":[],"how_to_check":"- Check whether the Windows Event Collector service (`wecsvc`) is running on the machine, for example with `sc query wecsvc`\n- Compare the Windows build against Microsoft's advisory for CVE-2026-112793 (unknown from these sources)","fix":null,"status":"open","published_at":"2026-11-10T19:18:41+00:00","first_seen_at":"2026-11-10T19:24:33+00:00","triaged_at":"2026-11-10T19:45:12+00:00","updated_at":"2026-11-10T19:45:12+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:45:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Event Collector: use-after-free lets a network user gain higher privileges","impact":"high","summary":"A use-after-free bug in the Windows Event Collector Service lets an attacker who already has an account on the network raise their privileges. The sources give no further detail on the trigger or the exact affected Windows builds.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","event-collector","windows-server"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker gains elevated privileges on the Windows host over the network","analyst_note":"Find Microsoft's advisory for CVE-2026-112793 to confirm affected Windows builds, the fixed update, and whether the service is enabled by default.","how_to_check":"- Check whether the Windows Event Collector service (`wecsvc`) is running on the machine, for example with `sc query wecsvc`\n- Compare the Windows build against Microsoft's advisory for CVE-2026-112793 (unknown from these sources)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines that run the Event Collector Service, which receives forwarded event logs from other computers, are the systems to look at. The sources do not say which Windows builds are affected or whether the service must be enabled by default, so exposure beyond that is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000713,"input_tokens":4484,"output_tokens":530,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find Microsoft's advisory for CVE-2026-112793 to confirm affected Windows builds, the fixed update, and whether the service is enabled by default.","search":"'-112793':17A,20A '-2026':16A,19A 'account':48B 'affect':67B 'allow':78C 'alreadi':45B 'attack':43B,81C 'author':80C 'bug':34B 'build':69B 'collector':3A,23B,39B,76C 'cve':15A,18A 'detail':60B 'elev':83C 'event':2A,22B,38B,75C 'event-collector':21B 'exact':66B 'free':7A,33B,72C 'gain':12A 'give':57B 'higher':13A 'infrastructur':24B 'let':8A,41B 'network':10A,51B,87C 'privileg':14A,54B,84C 'rais':52B 'server':28B 'servic':40B,77C 'sourc':56B 'trigger':63B 'use':5A,31B,70C 'use-after-fre':4A,30B 'user':11A 'window':1A,25B,27B,37B,68B,74C 'windows-serv':26B","nicknames":[],"mitigations":[],"who_affected":"Windows machines that run the Event Collector Service, which receives forwarded event logs from other computers, are the systems to look at. The sources do not say which Windows builds are affected or whether the service must be enabled by default, so exposure beyond that is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eventcollector","high","infrastructure","windows","windowsserver"],"campaign_type":null,"search_a":"'-112793':17A,20A '-2026':16A,19A 'collector':3A 'cve':15A,18A 'event':2A 'free':7A 'gain':12A 'higher':13A 'let':8A 'network':10A 'privileg':14A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A","search_b":"'account':48B 'affect':67B 'alreadi':45B 'attack':43B 'bug':34B 'build':69B 'collector':23B,39B 'detail':60B 'event':22B,38B 'event-collector':21B 'exact':66B 'free':33B 'give':57B 'infrastructur':24B 'let':41B 'network':51B 'privileg':54B 'rais':52B 'server':28B 'servic':40B 'sourc':56B 'trigger':63B 'use':31B 'use-after-fre':30B 'window':25B,27B,37B,68B 'windows-serv':26B","search_c":"'allow':78C 'attack':81C 'author':80C 'collector':76C 'elev':83C 'event':75C 'free':72C 'network':87C 'privileg':84C 'servic':77C 'use':70C 'window':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112793","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112793","severity":null,"published_at":"2026-11-10T19:18:41+00:00","modified_at":"2026-11-10T19:18:41+00:00","first_seen_at":"2026-11-10T19:24:33+00:00","fetched_at":"2026-11-10T19:24:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}