{"id":"CVE-2026-119853","kind":"vulnerability","aliases":["CVE-2026-119853"],"related":[],"title":"Windows: Remote Access API search path lets local users gain higher privileges","description":"Untrusted search path in Windows Remote Access API allows an authorized attacker to elevate privileges locally.","summary":"An untrusted search path in the Windows Remote Access API lets a local user who already has an account load code they control. Successful exploitation lets that user elevate privileges on the machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-users","windows"],"not_affected_if":["no-local-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:02+00:00","first_seen_at":"2026-11-10T19:24:59+00:00","triaged_at":"2026-11-10T19:40:22+00:00","updated_at":"2026-11-10T19:40:22+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:40:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: Remote Access API search path lets local users gain higher privileges","impact":"high","summary":"An untrusted search path in the Windows Remote Access API lets a local user who already has an account load code they control. Successful exploitation lets that user elevate privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","local-users"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains administrator or SYSTEM privileges on the machine","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-119853 for affected Windows builds and the patch.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Only Windows machines where a local user with some access could run code the attacker controls. The sources do not name the affected Windows builds, so the exact exposure is unknown. Machines with no untrusted local users are at lower risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000655,"input_tokens":4486,"output_tokens":412,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-119853 for affected Windows builds and the patch.","search":"'-119853':15A,18A '-2026':14A,17A 'access':3A,32B,63C 'account':42B 'allow':65C 'alreadi':39B 'api':4A,33B,64C 'attack':68C 'author':67C 'code':44B 'control':46B 'cve':13A,16A 'elev':52B,70C 'exploit':48B 'gain':10A 'higher':11A 'infrastructur':19B 'let':7A,34B,49B 'load':43B 'local':8A,21B,36B,72C 'local-us':20B 'machin':56B 'path':6A,27B,59C 'privileg':12A,53B,71C 'remot':2A,31B,62C 'search':5A,26B,58C 'success':47B 'untrust':25B,57C 'user':9A,22B,37B,51B 'window':1A,23B,30B,61C","nicknames":[],"mitigations":[],"who_affected":"Only Windows machines where a local user with some access could run code the attacker controls. The sources do not name the affected Windows builds, so the exact exposure is unknown. Machines with no untrusted local users are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localusers","windows"],"campaign_type":null,"search_a":"'-119853':15A,18A '-2026':14A,17A 'access':3A 'api':4A 'cve':13A,16A 'gain':10A 'higher':11A 'let':7A 'local':8A 'path':6A 'privileg':12A 'remot':2A 'search':5A 'user':9A 'window':1A","search_b":"'access':32B 'account':42B 'alreadi':39B 'api':33B 'code':44B 'control':46B 'elev':52B 'exploit':48B 'infrastructur':19B 'let':34B,49B 'load':43B 'local':21B,36B 'local-us':20B 'machin':56B 'path':27B 'privileg':53B 'remot':31B 'search':26B 'success':47B 'untrust':25B 'user':22B,37B,51B 'window':23B,30B","search_c":"'access':63C 'allow':65C 'api':64C 'attack':68C 'author':67C 'elev':70C 'local':72C 'path':59C 'privileg':71C 'remot':62C 'search':58C 'untrust':57C 'window':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119853","severity":null,"published_at":"2026-11-10T19:20:02+00:00","modified_at":"2026-11-10T19:20:03+00:00","first_seen_at":"2026-11-10T19:24:59+00:00","fetched_at":"2026-11-10T19:24:59+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}