{"id":"CVE-2026-118123","kind":"vulnerability","aliases":["CVE-2026-118123"],"related":[],"title":"Windows PPPoE race condition lets a local user gain SYSTEM-level privileges","description":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Point-to-Point Protocol over Ethernet (PPPoE) allows an authorized attacker to elevate privileges locally.","summary":"A race condition in the Windows Point-to-Point Protocol over Ethernet (PPPoE) component lets an authorized local attacker elevate their privileges. The sources do not describe a public exploit.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"windows-10-1607-server-2016","fixed":["10.0.14393.9688"],"affected":">= 10.0.14393.0, < 10.0.14393.9688","ecosystem":"microsoft"},{"name":"windows-10-1809-server-2019","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"microsoft"},{"name":"windows-10-21h2","fixed":["10.0.19044.7846"],"affected":">= 10.0.19044.0, < 10.0.19044.7846","ecosystem":"microsoft"},{"name":"windows-10-22h2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"microsoft"},{"name":"windows-11-23h2","fixed":["10.0.22631.7711"],"affected":">= 10.0.22631.0, < 10.0.22631.7711","ecosystem":"microsoft"},{"name":"windows-11-24h2","fixed":["10.0.26100.9974"],"affected":">= 10.0.26100.0, < 10.0.26100.9974","ecosystem":"microsoft"},{"name":"windows-11-25h2","fixed":["10.0.26200.9974"],"affected":">= 10.0.26200.0, < 10.0.26200.9974","ecosystem":"microsoft"},{"name":"windows-11-26h1","fixed":["10.0.28000.3501"],"affected":">= 10.0.28000.0, < 10.0.28000.3501","ecosystem":"microsoft"},{"name":"windows-11-26h2","fixed":["10.0.26300.9974"],"affected":">= 10.0.26300.0, < 10.0.26300.9974","ecosystem":"microsoft"},{"name":"windows-server-2022","fixed":["10.0.20348.5870"],"affected":">= 10.0.20348.0, < 10.0.20348.5870","ecosystem":"microsoft"},{"name":"windows-server-2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","local","pppoe","privilege-escalation","windows"],"not_affected_if":["no-local-accounts"],"how_to_check":"Run winver or [System.Environment]::OSVersion.Version (PowerShell) and compare the full build.revision with the fixed builds in the fix field. Anything lower is affected. Whether PPPoE must be configured for exposure is not stated in the sources found.","fix":"Install the November 2026 Windows cumulative update that brings the OS build to at least: Win10 1607/Server 2016 10.0.14393.9688; Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. KB numbers not yet confirmed.","status":"open","published_at":"2026-11-10T19:19:31+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","triaged_at":"2026-11-10T19:52:07+00:00","updated_at":"2026-11-10T23:27:00+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:52:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows PPPoE driver race condition lets a local user gain privileges","impact":"high","summary":"A race condition in the Windows Point-to-Point Protocol over Ethernet (PPPoE) component lets an authorized local attacker elevate their privileges. The sources do not describe a public exploit.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","pppoe"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher system privileges on the machine","analyst_note":"Find the Microsoft advisory for CVE-2026-118123 to confirm affected Windows builds, whether PPPoE must be enabled, and the patch KB.","how_to_check":"unknown","plain_action":"","product_name":"Windows PPPoE","needs_analyst":true,"not_affected_if":["no-local-accounts"],"who_is_affected":"Windows machines that use the PPPoE component are the systems to look at, since the flaw sits in the operating system's networking stack. The sources do not say which Windows builds are affected or whether PPPoE needs to be active, so the scope is unknown. Someone who already has a local account on the machine is the attacker in this scenario.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":4517,"output_tokens":492,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-118123 to confirm affected Windows builds, whether PPPoE must be enabled, and the patch KB.","search":"'-10':21A,26A,31A,35A '-11':39A,43A,47A,51A,55A '-118123':16A,19A '-1607':22A '-1809':27A '-2016':24A '-2019':29A '-2026':15A,18A '-21':32A '-22':36A '-23':40A '-24':44A '-25':48A '-26':52A,56A '2022':61A '2025':65A 'allow':124C 'attack':92B,127C 'author':90B,126C 'compon':87B 'concurr':104C 'condit':4A,75B,113C 'cve':14A,17A 'describ':100B 'elev':93B,129C 'escal':71B 'ethernet':85B,122C 'execut':105C 'exploit':103B 'gain':9A 'h1':53A 'h2':33A,37A,41A,45A,49A,57A 'improp':110C 'infrastructur':66B 'let':5A,88B 'level':12A 'local':7A,67B,91B,131C 'point':80B,82B,117C,119C 'point-to-point':79B,116C 'pppoe':2A,68B,86B,123C 'privileg':13A,70B,95B,130C 'privilege-escal':69B 'protocol':83B,120C 'public':102B 'race':3A,74B,112C 'resourc':108C 'server':23A,28A,60A,64A 'share':107C 'sourc':97B 'synchron':111C 'system':11A 'system-level':10A 'use':106C 'user':8A 'window':1A,72B,78B,115C 'windows':20A,25A,30A,34A,38A,42A,46A,50A,54A,59A,63A 'windows-server':58A,62A","nicknames":[],"mitigations":[],"who_affected":"Any supported Windows 10, Windows 11 or Windows Server build below the fixed build is listed by Microsoft as affected. The attacker needs an existing local account (CVSS AV:L/AC:H/PR:L), so shared machines, terminal servers and workstations where untrusted users or malware can run matter most. Single-user machines with no untrusted local code carry less risk, but patch them anyway. Whether PPPoE has to be in use is not stated in the sources found.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","local","pppoe","privilegeescalation","windows"],"campaign_type":null,"search_a":"'-10':21A,26A,31A,35A '-11':39A,43A,47A,51A,55A '-118123':16A,19A '-1607':22A '-1809':27A '-2016':24A '-2019':29A '-2026':15A,18A '-21':32A '-22':36A '-23':40A '-24':44A '-25':48A '-26':52A,56A '2022':61A '2025':65A 'condit':4A 'cve':14A,17A 'gain':9A 'h1':53A 'h2':33A,37A,41A,45A,49A,57A 'let':5A 'level':12A 'local':7A 'pppoe':2A 'privileg':13A 'race':3A 'server':23A,28A,60A,64A 'system':11A 'system-level':10A 'user':8A 'window':1A 'windows':20A,25A,30A,34A,38A,42A,46A,50A,54A,59A,63A 'windows-server':58A,62A","search_b":"'attack':92B 'author':90B 'compon':87B 'condit':75B 'describ':100B 'elev':93B 'escal':71B 'ethernet':85B 'exploit':103B 'infrastructur':66B 'let':88B 'local':67B,91B 'point':80B,82B 'point-to-point':79B 'pppoe':68B,86B 'privileg':70B,95B 'privilege-escal':69B 'protocol':83B 'public':102B 'race':74B 'sourc':97B 'window':72B,78B","search_c":"'allow':124C 'attack':127C 'author':126C 'concurr':104C 'condit':113C 'elev':129C 'ethernet':122C 'execut':105C 'improp':110C 'local':131C 'point':117C,119C 'point-to-point':116C 'pppoe':123C 'privileg':130C 'protocol':120C 'race':112C 'resourc':108C 'share':107C 'synchron':111C 'use':106C 'window':115C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118123","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118123","severity":null,"published_at":"2026-11-10T19:19:31+00:00","modified_at":"2026-11-10T19:19:31+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","fetched_at":"2026-11-10T19:24:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118123:3169","url":"https://app.opencve.io/cve/CVE-2026-118123","severity":null,"published_at":"2026-11-10T23:27:00+00:00","modified_at":"2026-11-10T23:27:00+00:00","first_seen_at":"2026-11-10T23:27:00+00:00","fetched_at":"2026-11-10T23:27:00+00:00","note":"Could not load the MSRC page (JS-only), so nothing is marked verified. Fixed build numbers come from Microsoft's CNA record as mirrored by OpenCVE and NVD. KB numbers and whether PPPoE must be enabled are not found.","cites":["https://app.opencve.io/cve/CVE-2026-118123","https://nvd.nist.gov/vuln/detail/CVE-2026-118123"]}],"documents":[{"id":120162,"url":"https://app.opencve.io/cve/CVE-2026-118123","title":"OpenCVE: CVE-2026-118123 (mirrors Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120163,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118123","title":"NVD: CVE-2026-118123","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}