---
id: "CVE-2026-112793"
page: "https://infrastack.ai/live/CVE-2026-112793"
kind: "vulnerability"
aliases: ["CVE-2026-112793"]
title: "Windows Event Collector: use-after-free lets a network user gain higher privileges"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 10 1607 / Server 2016", "fixed": ["10.0.14393.9688"], "affected": ">= 10.0.14393.0, < 10.0.14393.9688", "ecosystem": "microsoft"}, {"name": "Windows 10 1809 / Server 2019", "fixed": ["10.0.17763.9487"], "affected": ">= 10.0.17763.0, < 10.0.17763.9487", "ecosystem": "microsoft"}, {"name": "Windows 10 21H2", "fixed": ["10.0.19044.7846"], "affected": ">= 10.0.19044.0, < 10.0.19044.7846", "ecosystem": "microsoft"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": ">= 10.0.19045.0, < 10.0.19045.7846", "ecosystem": "microsoft"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": ">= 10.0.22631.0, < 10.0.22631.7711", "ecosystem": "microsoft"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": ">= 10.0.26100.0, < 10.0.26100.9974", "ecosystem": "microsoft"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9974"], "affected": ">= 10.0.26200.0, < 10.0.26200.9974", "ecosystem": "microsoft"}, {"name": "Windows 11 26H1", "fixed": ["10.0.28000.3501"], "affected": ">= 10.0.28000.0, < 10.0.28000.3501", "ecosystem": "microsoft"}, {"name": "Windows 11 26H2", "fixed": ["10.0.26300.9974"], "affected": ">= 10.0.26300.0, < 10.0.26300.9974", "ecosystem": "microsoft"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": ">= 10.0.20348.0, < 10.0.20348.5870", "ecosystem": "microsoft"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": ">= 10.0.26100.0, < 10.0.26100.33822", "ecosystem": "microsoft"}]
ecosystems: []
tags: ["event-collector", "infrastructure", "wef", "windows", "windows-server"]
not_affected_if: ["patched-build", "wecsvc-disabled"]
published_at: "2026-11-10T19:18:41+00:00"
first_seen_at: "2026-11-10T19:24:33+00:00"
updated_at: "2026-11-11T00:07:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112793", "first_seen_at": "2026-11-10T19:24:33+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/cve-2026-112793", "first_seen_at": "2026-11-11T00:07:06+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/cve-2026-112793"]}]
exploit_sources: []
---

# Windows Event Collector: use-after-free lets a network user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-112793 (this .md is for agents)

A use-after-free bug in the Windows Event Collector Service lets an attacker who already has an account on the network raise their privileges. The sources give no further detail on the trigger or the exact affected Windows builds.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- microsoft:Windows 10 1607 / Server 2016 affected >= 10.0.14393.0, < 10.0.14393.9688 fixed 10.0.14393.9688
- microsoft:Windows 10 1809 / Server 2019 affected >= 10.0.17763.0, < 10.0.17763.9487 fixed 10.0.17763.9487
- microsoft:Windows 10 21H2 affected >= 10.0.19044.0, < 10.0.19044.7846 fixed 10.0.19044.7846
- microsoft:Windows 10 22H2 affected >= 10.0.19045.0, < 10.0.19045.7846 fixed 10.0.19045.7846
- microsoft:Windows 11 23H2 affected >= 10.0.22631.0, < 10.0.22631.7711 fixed 10.0.22631.7711
- microsoft:Windows 11 24H2 affected >= 10.0.26100.0, < 10.0.26100.9974 fixed 10.0.26100.9974
- microsoft:Windows 11 25H2 affected >= 10.0.26200.0, < 10.0.26200.9974 fixed 10.0.26200.9974
- microsoft:Windows 11 26H1 affected >= 10.0.28000.0, < 10.0.28000.3501 fixed 10.0.28000.3501
- microsoft:Windows 11 26H2 affected >= 10.0.26300.0, < 10.0.26300.9974 fixed 10.0.26300.9974
- microsoft:Windows Server 2022 affected >= 10.0.20348.0, < 10.0.20348.5870 fixed 10.0.20348.5870
- microsoft:Windows Server 2025 affected >= 10.0.26100.0, < 10.0.26100.33822 fixed 10.0.26100.33822

## How to check

1. Run 'sc query wecsvc' (or 'Get-Service wecsvc'); if it is not running and no collector subscriptions are configured, the vulnerable service is not in use.
2. Run 'winver' or '[System.Environment]::OSVersion.Version' and compare the build to the fixed builds listed in --fix; anything lower is affected.
3. 'wecutil es' lists configured subscriptions on a collector.

## Fix

Install the November 2026 Windows cumulative update that brings the OS build to at least the fixed build for your version (e.g. Windows 11 24H2 10.0.26100.9974, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822, Server 2019 10.0.17763.9487, Server 2016 10.0.14393.9688). KB numbers: see MSRC page.

## Timeline

- 2026-11-10T19:24:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112793
- 2026-11-11T00:07:06+00:00 analyst https://nvd.nist.gov/vuln/detail/cve-2026-112793 — MSRC page is JS-only and returned nothing; affected builds taken from Microsoft CNA data as relayed by NVD (not verified against MSRC). Not stated: KB numbers, default-enabled status of wecsvc, exploitation. No PoC/exploitation found.

## Documents

- [describes] NVD CVE-2026-112793 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/cve-2026-112793

## From the sources

Use after free in Windows Event Collector Service allows an authorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_