{"id":"CVE-2026-113865","kind":"vulnerability","aliases":["CVE-2026-113865"],"related":[],"title":"Windows Hyper-V: race condition lets a local user gain higher privileges","description":"Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","summary":"A time-of-check time-of-use race condition in Windows Hyper-V lets an authorized local attacker elevate privileges on the machine. The NVD entry rates it high (CVSS 7.8) and says nothing about exploitation in the wild.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hyper-v","infrastructure","windows","windows-server"],"not_affected_if":["hyper-v-not-enabled","hyper-v-not-installed","no-local-accounts"],"how_to_check":"- Check the Windows build and patch level with `winver` or `Get-ComputerInfo` and compare it with the fixed build in Microsoft's advisory, which the sources do not name.\n- Check whether the Hyper-V role is installed, for example with `Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V`.","fix":null,"status":"open","published_at":"2026-11-10T19:19:07+00:00","first_seen_at":"2026-11-10T19:24:43+00:00","triaged_at":"2026-11-10T19:40:54+00:00","updated_at":"2026-11-10T23:46:38+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:40:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Hyper-V: race condition lets a local user gain higher privileges","impact":"high","summary":"A time-of-check time-of-use race condition in Windows Hyper-V lets an authorized local attacker elevate privileges on the machine. The NVD entry rates it high (CVSS 7.8) and says nothing about exploitation in the wild.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","hyper-v","windows-server"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows host","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-113865 to get fixed builds and Hyper-V trigger conditions; the NVD entry alone does not give them.","how_to_check":"- Check the Windows build and patch level with `winver` or `Get-ComputerInfo` and compare it with the fixed build in Microsoft's advisory, which the sources do not name.\n- Check whether the Hyper-V role is installed, for example with `Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["hyper-v-not-enabled","no-local-accounts"],"who_is_affected":"Affects Windows hosts running the Hyper-V role, where a user already holds an account on the machine. Machines without Hyper-V enabled are not covered by this description. The sources do not give the fixed builds or the exact trigger conditions.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000752,"input_tokens":4506,"output_tokens":602,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-113865 to get fixed builds and Hyper-V trigger conditions; the NVD entry alone does not give them.","search":"'-113865':16A,19A '-2026':15A,18A '7.8':61B 'allow':86C 'attack':48B,89C 'author':46B,88C 'check':32B,73C 'condit':6A,38B,80C 'cve':14A,17A 'cvss':60B 'elev':49B,91C 'entri':56B 'exploit':66B 'gain':11A 'high':59B 'higher':12A 'hyper':3A,21B,42B,84C 'hyper-v':2A,20B,41B,83C 'infrastructur':23B 'let':7A,44B 'local':9A,47B,93C 'machin':53B 'noth':64B 'nvd':55B 'privileg':13A,50B,92C 'race':5A,37B,79C 'rate':57B 'say':63B 'server':27B 'time':30B,34B,71C,75C 'time-of-check':29B,70C 'time-of-us':33B,74C 'toctou':78C 'use':36B,77C 'user':10A 'v':4A,22B,43B,85C 'wild':69B 'window':1A,24B,26B,40B,82C 'windows-serv':25B","nicknames":[],"mitigations":[],"who_affected":"Windows hosts and Windows Server machines with the Hyper-V role enabled may be affected by this local privilege escalation; an attacker needs local access. Affected builds are not confirmed because Microsoft's advisory could not be read. Machines without Hyper-V, or with no untrusted local users, are lower priority until the advisory is read.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","hyperv","infrastructure","windows","windowsserver"],"campaign_type":null,"search_a":"'-113865':16A,19A '-2026':15A,18A 'condit':6A 'cve':14A,17A 'gain':11A 'higher':12A 'hyper':3A 'hyper-v':2A 'let':7A 'local':9A 'privileg':13A 'race':5A 'user':10A 'v':4A 'window':1A","search_b":"'7.8':61B 'attack':48B 'author':46B 'check':32B 'condit':38B 'cvss':60B 'elev':49B 'entri':56B 'exploit':66B 'high':59B 'hyper':21B,42B 'hyper-v':20B,41B 'infrastructur':23B 'let':44B 'local':47B 'machin':53B 'noth':64B 'nvd':55B 'privileg':50B 'race':37B 'rate':57B 'say':63B 'server':27B 'time':30B,34B 'time-of-check':29B 'time-of-us':33B 'use':36B 'v':22B,43B 'wild':69B 'window':24B,26B,40B 'windows-serv':25B","search_c":"'allow':86C 'attack':89C 'author':88C 'check':73C 'condit':80C 'elev':91C 'hyper':84C 'hyper-v':83C 'local':93C 'privileg':92C 'race':79C 'time':71C,75C 'time-of-check':70C 'time-of-us':74C 'toctou':78C 'use':77C 'v':85C 'window':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113865","severity":null,"published_at":"2026-11-10T19:19:07+00:00","modified_at":"2026-11-10T19:19:07+00:00","first_seen_at":"2026-11-10T19:24:43+00:00","fetched_at":"2026-11-10T19:24:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113865:3230","url":null,"severity":null,"published_at":"2026-11-10T23:46:38+00:00","modified_at":"2026-11-10T23:46:38+00:00","first_seen_at":"2026-11-10T23:46:38+00:00","fetched_at":"2026-11-10T23:46:38+00:00","note":"MSRC page unreachable (update guide is JS-only, CVRF API 404; web-cli not available as a tool this run). No fixed build, affected builds or exploitation status read; nothing verified. Revisit when MSRC details can be read."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}