{"id":"CVE-2026-119860","kind":"vulnerability","aliases":["CVE-2026-119860"],"related":[],"title":"Windows Internet Connection Sharing: use-after-free lets local user gain privileges","description":"Use after free in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in Windows Internet Connection Sharing (ICS) lets an attacker who already has an account on the machine raise their privileges. The sources do not describe the exact trigger beyond this.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Internet Connection Sharing","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","internet-connection-sharing","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:04+00:00","first_seen_at":"2026-11-10T19:24:59+00:00","triaged_at":"2026-11-10T19:51:42+00:00","updated_at":"2026-11-10T19:51:42+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:51:42Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Windows Internet Connection Sharing: use-after-free lets local user gain privileges","impact":"high","summary":"A use-after-free bug in Windows Internet Connection Sharing (ICS) lets an attacker who already has an account on the machine raise their privileges. The sources do not describe the exact trigger beyond this.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","internet-connection-sharing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the affected Windows builds and the Microsoft advisory for CVE-2026-119860 to confirm fixed versions and whether ICS must be enabled.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Internet Connection Sharing","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Affects Windows systems where Internet Connection Sharing is in use and where a local, authorized user could be hostile. The sources do not say which Windows versions or configurations are affected, so whether a given machine is exposed is unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00069,"input_tokens":4498,"output_tokens":481,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and the Microsoft advisory for CVE-2026-119860 to confirm fixed versions and whether ICS must be enabled.","search":"'-119860':16A,19A '-2026':15A,18A 'account':49B 'allow':74C 'alreadi':46B 'attack':44B,77C 'author':76C 'beyond':64B 'bug':35B 'connect':3A,27B,39B,71C 'connection':22A 'cve':14A,17A 'describ':60B 'elev':79C 'exact':62B 'free':8A,34B,67C 'gain':12A 'ic':41B,73C 'infrastructur':24B 'internet':2A,21A,26B,38B,70C 'internet-connection-shar':25B 'let':9A,42B 'local':10A,81C 'machin':52B 'privileg':13A,55B,80C 'rais':53B 'share':4A,28B,40B,72C 'sharing':23A 'sourc':57B 'trigger':63B 'use':6A,32B,65C 'use-after-fre':5A,31B 'user':11A 'window':1A,29B,37B,69C 'windows':20A","nicknames":[],"mitigations":[],"who_affected":"Affects Windows systems where Internet Connection Sharing is in use and where a local, authorized user could be hostile. The sources do not say which Windows versions or configurations are affected, so whether a given machine is exposed is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["internetconnectionsharing","windowsinternetconnectionsharing"],"ptokens":["connection","internet","sharing","windows"],"labels":["high","infrastructure","internetconnectionsharing","vendor","windows"],"campaign_type":null,"search_a":"'-119860':16A,19A '-2026':15A,18A 'connect':3A 'connection':22A 'cve':14A,17A 'free':8A 'gain':12A 'internet':2A,21A 'let':9A 'local':10A 'privileg':13A 'share':4A 'sharing':23A 'use':6A 'use-after-fre':5A 'user':11A 'window':1A 'windows':20A","search_b":"'account':49B 'alreadi':46B 'attack':44B 'beyond':64B 'bug':35B 'connect':27B,39B 'describ':60B 'exact':62B 'free':34B 'ic':41B 'infrastructur':24B 'internet':26B,38B 'internet-connection-shar':25B 'let':42B 'machin':52B 'privileg':55B 'rais':53B 'share':28B,40B 'sourc':57B 'trigger':63B 'use':32B 'use-after-fre':31B 'window':29B,37B","search_c":"'allow':74C 'attack':77C 'author':76C 'connect':71C 'elev':79C 'free':67C 'ic':73C 'internet':70C 'local':81C 'privileg':80C 'share':72C 'use':65C 'window':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119860","severity":null,"published_at":"2026-11-10T19:20:04+00:00","modified_at":"2026-11-10T19:20:04+00:00","first_seen_at":"2026-11-10T19:24:59+00:00","fetched_at":"2026-11-10T19:24:59+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}