{"id":"CVE-2026-119851","kind":"vulnerability","aliases":["CVE-2026-119851"],"related":[],"title":"Windows Storage Spaces Controller race lets a local user gain privileges","description":"Time-of-check time-of-use (toctou) race condition in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.","summary":"A time-of-check time-of-use race condition in the Windows Storage Spaces Controller lets an authorized local user elevate their privileges. An attacker who already has a local account can use it to gain higher rights on the machine.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":"10.0.14393.0 - < 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"10.0.17763.0 - < 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"10.0.19044.0 - < 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"10.0.19045.0 - < 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"10.0.22631.0 - < 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2 / Server 2025 base","fixed":["10.0.26100.9974"],"affected":"10.0.26100.0 - < 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"10.0.26200.0 - < 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"10.0.28000.0 - < 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"10.0.26300.0 - < 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"10.0.20348.0 - < 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"10.0.26100.0 - < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","storage-spaces","windows","windows-server"],"not_affected_if":["no-local-accounts","patched-november-2026"],"how_to_check":"Run winver or [System.Environment]::OSVersion / (Get-ComputerInfo).OsBuildNumber, compare the full build (e.g. 10.0.19045.xxxx) with the fixed builds in the fix field. Lower means exposed. Lower priority if no untrusted local users can log in.","fix":"Install the November 2026 Patch Tuesday cumulative update so the build is at or above: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2/25H2/26H2 10.0.26100.9974 / 26200.9974 / 26300.9974; Win11 26H1 10.0.28000.3501; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822.","status":"open","published_at":"2026-11-10T19:20:02+00:00","first_seen_at":"2026-11-10T19:24:59+00:00","triaged_at":"2026-11-10T19:51:44+00:00","updated_at":"2026-11-10T22:46:46+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:51:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Storage Spaces Controller race lets a local user gain privileges","impact":"high","summary":"A time-of-check time-of-use race condition in the Windows Storage Spaces Controller lets an authorized local user elevate their privileges. An attacker who already has a local account can use it to gain higher rights on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","storage-spaces"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains administrator or system privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for affected Windows builds and the patch, since NVD gives no product ranges.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-accounts"],"who_is_affected":"Only Windows machines using Storage Spaces are relevant, and the attacker needs a local account first. The sources do not say which Windows builds are affected or which patch addresses it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":4510,"output_tokens":418,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for affected Windows builds and the patch, since NVD gives no product ranges.","search":"'-119851':14A,17A '-2026':13A,16A '10':19A,24A,29A,32A '11':35A,38A,44A,47A,50A '1607':20A '1809':25A '2016':22A '2019':27A '2022':54A '2025':41A,57A '21h2':30A '22h2':33A '23h2':36A '24h2':39A '25h2':45A '26h1':48A '26h2':51A 'account':102B 'allow':129C 'alreadi':98B 'attack':96B,132C 'author':89B,131C 'base':42A 'check':74B,116C 'condit':80B,123C 'control':4A,86B,128C 'cve':12A,15A 'elev':92B,134C 'escal':62B 'gain':10A,107B 'higher':108B 'infrastructur':58B 'let':6A,87B 'local':8A,60B,90B,101B,136C 'local-privilege-escal':59B 'machin':112B 'privileg':11A,61B,94B,135C 'race':5A,79B,122C 'right':109B 'server':21A,26A,40A,53A,56A,69B 'space':3A,65B,85B,127C 'storag':2A,64B,84B,126C 'storage-spac':63B 'time':72B,76B,114C,118C 'time-of-check':71B,113C 'time-of-us':75B,117C 'toctou':121C 'use':78B,104B,120C 'user':9A,91B 'window':1A,66B,68B,83B,125C 'windows':18A,23A,28A,31A,34A,37A,43A,46A,49A,52A,55A 'windows-serv':67B","nicknames":[],"mitigations":[],"who_affected":"Only Windows machines using Storage Spaces are relevant, and the attacker needs a local account first. The sources do not say which Windows builds are affected or which patch addresses it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2server2025base","1125h2","1126h1","1126h2","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2server2025base","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","base","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","storagespaces","windows","windowsserver"],"campaign_type":null,"search_a":"'-119851':14A,17A '-2026':13A,16A '10':19A,24A,29A,32A '11':35A,38A,44A,47A,50A '1607':20A '1809':25A '2016':22A '2019':27A '2022':54A '2025':41A,57A '21h2':30A '22h2':33A '23h2':36A '24h2':39A '25h2':45A '26h1':48A '26h2':51A 'base':42A 'control':4A 'cve':12A,15A 'gain':10A 'let':6A 'local':8A 'privileg':11A 'race':5A 'server':21A,26A,40A,53A,56A 'space':3A 'storag':2A 'user':9A 'window':1A 'windows':18A,23A,28A,31A,34A,37A,43A,46A,49A,52A,55A","search_b":"'account':102B 'alreadi':98B 'attack':96B 'author':89B 'check':74B 'condit':80B 'control':86B 'elev':92B 'escal':62B 'gain':107B 'higher':108B 'infrastructur':58B 'let':87B 'local':60B,90B,101B 'local-privilege-escal':59B 'machin':112B 'privileg':61B,94B 'race':79B 'right':109B 'server':69B 'space':65B,85B 'storag':64B,84B 'storage-spac':63B 'time':72B,76B 'time-of-check':71B 'time-of-us':75B 'use':78B,104B 'user':91B 'window':66B,68B,83B 'windows-serv':67B","search_c":"'allow':129C 'attack':132C 'author':131C 'check':116C 'condit':123C 'control':128C 'elev':134C 'local':136C 'privileg':135C 'race':122C 'space':127C 'storag':126C 'time':114C,118C 'time-of-check':113C 'time-of-us':117C 'toctou':121C 'use':120C 'window':125C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119851","severity":null,"published_at":"2026-11-10T19:20:02+00:00","modified_at":"2026-11-10T19:20:02+00:00","first_seen_at":"2026-11-10T19:24:59+00:00","fetched_at":"2026-11-10T19:24:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119851:3043","url":"https://app.opencve.io/cve/CVE-2026-119851","severity":null,"published_at":"2026-11-10T22:46:46+00:00","modified_at":"2026-11-10T22:46:46+00:00","first_seen_at":"2026-11-10T22:46:46+00:00","fetched_at":"2026-11-10T22:46:46+00:00","note":"Affected builds and fixed builds come from Microsoft's CNA record as mirrored by OpenCVE. MSRC page is JS-only and unreadable, so nothing marked verified. Not in KEV, no PoC found, not exploited. KB per build not confirmed (KB5131096 is the Win10 ESU update per BleepingComputer).","cites":["https://app.opencve.io/cve/CVE-2026-119851"]}],"documents":[{"id":119730,"url":"https://app.opencve.io/cve/CVE-2026-119851","title":"OpenCVE: CVE-2026-119851 (mirror of Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}