{"id":"CVE-2026-119405","kind":"vulnerability","aliases":["CVE-2026-119405"],"related":[],"title":"Windows: Backup Engine use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Backup Engine allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in the Windows Backup Engine lets an attacker who already has a local account raise their privileges. The sources say nothing about a remote trigger.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:19:55+00:00","first_seen_at":"2026-11-10T19:24:57+00:00","triaged_at":"2026-11-10T19:51:54+00:00","updated_at":"2026-11-10T19:51:54+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:51:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: Backup Engine use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in the Windows Backup Engine lets an attacker who already has a local account raise their privileges. The sources say nothing about a remote trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"A local user gains SYSTEM-level privileges on the machine","analyst_note":"Find Microsoft's advisory for CVE-2026-119405 to get affected Windows builds, the fixed update, and whether exploitation is seen.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Machines running Windows where local users can sign in and the Windows Backup Engine component is present. The sources do not list affected Windows builds, so unknown which versions are exposed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":4480,"output_tokens":401,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find Microsoft's advisory for CVE-2026-119405 to get affected Windows builds, the fixed update, and whether exploitation is seen.","search":"'-119405':17A,20A '-2026':16A,19A 'account':42B 'allow':61C 'alreadi':38B 'attack':36B,64C 'author':63C 'backup':2A,32B,59C 'bug':28B 'cve':15A,18A 'elev':66C 'engin':3A,33B,60C 'free':7A,27B,56C 'gain':12A 'higher':13A 'infrastructur':21B 'let':8A,34B 'local':10A,41B,68C 'noth':49B 'privileg':14A,45B,67C 'rais':43B 'remot':52B 'say':48B 'sourc':47B 'trigger':53B 'use':5A,25B,54C 'use-after-fre':4A,24B 'user':11A 'window':1A,22B,31B,58C","nicknames":[],"mitigations":[],"who_affected":"Machines running Windows where local users can sign in and the Windows Backup Engine component is present. The sources do not list affected Windows builds, so unknown which versions are exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows"],"campaign_type":null,"search_a":"'-119405':17A,20A '-2026':16A,19A 'backup':2A 'cve':15A,18A 'engin':3A 'free':7A 'gain':12A 'higher':13A 'let':8A 'local':10A 'privileg':14A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A","search_b":"'account':42B 'alreadi':38B 'attack':36B 'backup':32B 'bug':28B 'engin':33B 'free':27B 'infrastructur':21B 'let':34B 'local':41B 'noth':49B 'privileg':45B 'rais':43B 'remot':52B 'say':48B 'sourc':47B 'trigger':53B 'use':25B 'use-after-fre':24B 'window':22B,31B","search_c":"'allow':61C 'attack':64C 'author':63C 'backup':59C 'elev':66C 'engin':60C 'free':56C 'local':68C 'privileg':67C 'use':54C 'window':58C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119405","severity":null,"published_at":"2026-11-10T19:19:55+00:00","modified_at":"2026-11-10T19:19:55+00:00","first_seen_at":"2026-11-10T19:24:57+00:00","fetched_at":"2026-11-10T19:24:57+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}