{"id":"CVE-2026-113766","kind":"vulnerability","aliases":["CVE-2026-113766"],"related":[],"title":"Windows Language Experience Service: weak authentication lets a local user tamper","description":"Weak authentication in Windows Language Experience Service allows an authorized attacker to perform tampering locally.","summary":"Windows Language Experience Service has weak authentication, so an attacker who already holds a valid account on the machine can tamper with it. The sources give no further detail on what can be changed.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows"],"not_affected_if":["no-local-user-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:55+00:00","first_seen_at":"2026-11-10T19:24:40+00:00","triaged_at":"2026-11-10T20:04:37+00:00","updated_at":"2026-11-10T20:04:37+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:04:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Language Experience Service: weak authentication lets a local user tamper","impact":"low","summary":"Windows Language Experience Service has weak authentication, so an attacker who already holds a valid account on the machine can tamper with it. The sources give no further detail on what can be changed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user tampers with the language experience service","analyst_note":"","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-local-user-access"],"who_is_affected":"Only Windows machines with the Language Experience Service present are in scope, and the attacker must already be an authorized local user. The sources do not say which Windows builds are affected or what default configuration applies.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000626,"input_tokens":4484,"output_tokens":356,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-113766':14A,17A '-2026':13A,16A 'account':35B 'allow':61C 'alreadi':31B 'attack':29B,64C 'authent':6A,26B,55C 'author':63C 'chang':53B 'cve':12A,15A 'detail':48B 'experi':3A,22B,59C 'give':45B 'hold':32B 'infrastructur':18B 'languag':2A,21B,58C 'let':7A 'local':9A,68C 'machin':38B 'perform':66C 'servic':4A,23B,60C 'sourc':44B 'tamper':11A,40B,67C 'user':10A 'valid':34B 'weak':5A,25B,54C 'window':1A,19B,20B,57C","nicknames":[],"mitigations":[],"who_affected":"Only Windows machines with the Language Experience Service present are in scope, and the attacker must already be an authorized local user. The sources do not say which Windows builds are affected or what default configuration applies.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","low","windows"],"campaign_type":null,"search_a":"'-113766':14A,17A '-2026':13A,16A 'authent':6A 'cve':12A,15A 'experi':3A 'languag':2A 'let':7A 'local':9A 'servic':4A 'tamper':11A 'user':10A 'weak':5A 'window':1A","search_b":"'account':35B 'alreadi':31B 'attack':29B 'authent':26B 'chang':53B 'detail':48B 'experi':22B 'give':45B 'hold':32B 'infrastructur':18B 'languag':21B 'machin':38B 'servic':23B 'sourc':44B 'tamper':40B 'valid':34B 'weak':25B 'window':19B,20B","search_c":"'allow':61C 'attack':64C 'authent':55C 'author':63C 'experi':59C 'languag':58C 'local':68C 'perform':66C 'servic':60C 'tamper':67C 'weak':54C 'window':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113766","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113766","severity":null,"published_at":"2026-11-10T19:18:55+00:00","modified_at":"2026-11-10T19:18:56+00:00","first_seen_at":"2026-11-10T19:24:40+00:00","fetched_at":"2026-11-10T19:24:40+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}