{"id":"CVE-2026-119859","kind":"vulnerability","aliases":["CVE-2026-119859"],"related":[],"title":"Windows Internet Connection Sharing use-after-free lets a local user gain privileges (Windows 11 24H2 to 26H2, Server 2025)","description":"Use after free in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in Windows Internet Connection Sharing (ICS) lets an authorized local user elevate their privileges. An attacker who already has a low-privilege account on the machine can gain higher rights.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","internet-connection-sharing","local-privilege-escalation","windows","windows-11","windows-server-2025"],"not_affected_if":["ics-disabled"],"how_to_check":"Run winver or (Get-ComputerInfo).OsBuildNumber and compare the full build (e.g. 10.0.26100.xxxx) with the fixed builds. Builds below the fixed one are exposed. Only machines with ICS enabled (sc query SharedAccess shows RUNNING) are likely reachable; this is not confirmed by Microsoft's page.","fix":"Install the November 10, 2026 cumulative update: Windows 11 24H2/25H2 KB5132061 (build 26100.9974 / 26200.9974), 26H2 KB5132061 (26300.9974), 26H1 KB5132059 (28000.3501); Windows Server 2025 build 10.0.26100.33822 or later (KB not confirmed).","status":"open","published_at":"2026-11-10T19:20:04+00:00","first_seen_at":"2026-11-10T19:24:59+00:00","triaged_at":"2026-11-10T19:51:45+00:00","updated_at":"2026-11-10T22:47:03+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:51:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: Internet Connection Sharing use-after-free lets local users gain privileges","impact":"high","summary":"A use-after-free bug in Windows Internet Connection Sharing (ICS) lets an authorized local user elevate their privileges. An attacker who already has a low-privilege account on the machine can gain higher rights.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","internet-connection-sharing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level control of the Windows machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119859 for affected Windows builds and the patch; the NVD entry gives only the description and CVSS 7.0.","how_to_check":"- Check whether the Internet Connection Sharing service (SharedAccess) is running on Windows machines with `sc query SharedAccess`\n- Confirm the Windows build and update level with `winver` or `Get-ComputerInfo`\n- unknown for any other check, as the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["ics-disabled"],"who_is_affected":"Windows machines where a user has a local account and ICS is in use or installed. Servers and workstations that do not use Internet Connection Sharing are less exposed, but the sources do not say which builds are affected. Systems with no local untrusted users carry lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000733,"input_tokens":4498,"output_tokens":567,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119859 for affected Windows builds and the patch; the NVD entry gives only the description and CVSS 7.0.","search":"'-11':54B '-119859':24A,27A '-2026':23A,26A '11':16A,29A,32A,35A,38A '2025':21A,42A,58B '24h2':17A,30A '25h2':33A '26h1':36A '26h2':19A,39A 'account':88B 'allow':105C 'alreadi':82B 'attack':80B,108C 'author':73B,107C 'bug':64B 'connect':3A,46B,68B,102C 'cve':22A,25A 'elev':76B,110C 'escal':51B 'free':8A,63B,98C 'gain':13A,93B 'higher':94B 'ic':70B,104C 'infrastructur':43B 'internet':2A,45B,67B,101C 'internet-connection-shar':44B 'let':9A,71B 'local':11A,49B,74B,112C 'local-privilege-escal':48B 'low':86B 'low-privileg':85B 'machin':91B 'privileg':14A,50B,78B,87B,111C 'right':95B 'server':20A,41A,57B 'share':4A,47B,69B,103C 'use':6A,61B,96C 'use-after-fre':5A,60B 'user':12A,75B 'window':1A,15A,52B,53B,56B,66B,100C 'windows':28A,31A,34A,37A,40A 'windows-serv':55B","nicknames":[],"mitigations":[],"who_affected":"Windows 11 24H2, 25H2, 26H1 and 26H2 and Windows Server 2025 (including Server Core) are listed as affected below the November 2026 builds. An attacker needs a local low-privilege account; the CVSS vector is local, high complexity, no user interaction. Machines that nobody else can log into, or that are already patched, can skip it. Windows 10 and Windows 11 23H2 are not listed for this CVE (sibling CVEs list them).","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1124h2","1125h2","1126h1","1126h2","server2025","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2025"],"ptokens":["11","2025","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","internetconnectionsharing","localprivilegeescalation","windows","windows11","windowsserver2025"],"campaign_type":null,"search_a":"'-119859':24A,27A '-2026':23A,26A '11':16A,29A,32A,35A,38A '2025':21A,42A '24h2':17A,30A '25h2':33A '26h1':36A '26h2':19A,39A 'connect':3A 'cve':22A,25A 'free':8A 'gain':13A 'internet':2A 'let':9A 'local':11A 'privileg':14A 'server':20A,41A 'share':4A 'use':6A 'use-after-fre':5A 'user':12A 'window':1A,15A 'windows':28A,31A,34A,37A,40A","search_b":"'-11':54B '2025':58B 'account':88B 'alreadi':82B 'attack':80B 'author':73B 'bug':64B 'connect':46B,68B 'elev':76B 'escal':51B 'free':63B 'gain':93B 'higher':94B 'ic':70B 'infrastructur':43B 'internet':45B,67B 'internet-connection-shar':44B 'let':71B 'local':49B,74B 'local-privilege-escal':48B 'low':86B 'low-privileg':85B 'machin':91B 'privileg':50B,78B,87B 'right':95B 'server':57B 'share':47B,69B 'use':61B 'use-after-fre':60B 'user':75B 'window':52B,53B,56B,66B 'windows-serv':55B","search_c":"'allow':105C 'attack':108C 'author':107C 'connect':102C 'elev':110C 'free':98C 'ic':104C 'internet':101C 'local':112C 'privileg':111C 'share':103C 'use':96C 'window':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119859","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119859","severity":null,"published_at":"2026-11-10T19:20:04+00:00","modified_at":"2026-11-10T19:20:04+00:00","first_seen_at":"2026-11-10T19:24:59+00:00","fetched_at":"2026-11-10T19:24:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119859:3040","url":"https://app.opencve.io/cve/CVE-2026-119859","severity":null,"published_at":"2026-11-10T22:47:03+00:00","modified_at":"2026-11-10T22:47:03+00:00","first_seen_at":"2026-11-10T22:47:03+00:00","fetched_at":"2026-11-10T22:47:03+00:00","note":"MSRC page is JS-only and unreadable here, so nothing marked verified. Affected builds and fixed builds come from the OpenCVE mirror of Microsoft's CNA record; the Nov 10 2026 cumulative update build numbers match Winaero. No exploitation or PoC found. Did not search X or posts.","cites":["https://app.opencve.io/cve/CVE-2026-119859","https://winaero.com/patch-tuesday-cumulative-updates-for-windows-11-and-10-november-10-2026/"]}],"documents":[{"id":119734,"url":"https://app.opencve.io/cve/CVE-2026-119859","title":"OpenCVE: CVE-2026-119859 (mirror of Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":118027,"url":"https://winaero.com/patch-tuesday-cumulative-updates-for-windows-11-and-10-november-10-2026/","title":"Patch Tuesday cumulative updates, November 10, 2026 (Winaero)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}