{"id":"CVE-2026-119868","kind":"vulnerability","aliases":["CVE-2026-119868"],"related":[],"title":"Windows Kernel: race condition lets a local user gain higher privileges","description":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"A race condition in the Windows kernel lets an authorized attacker on the machine elevate their privileges. The attacker needs a valid local account and must run code on the affected system.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","windows"],"not_affected_if":["no-local-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:05+00:00","first_seen_at":"2026-11-10T19:25:00+00:00","triaged_at":"2026-11-10T19:51:38+00:00","updated_at":"2026-11-10T19:51:38+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:51:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Kernel: race condition lets a local user gain higher privileges","impact":"high","summary":"A race condition in the Windows kernel lets an authorized attacker on the machine elevate their privileges. The attacker needs a valid local account and must run code on the affected system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","kernel"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-119868 for affected builds and the patch KB; sources here give only the NVD description.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Any Windows system where an untrusted or low-privilege user can run code locally is exposed. Systems where only administrators log in and no untrusted local users exist carry less practical risk. The sources do not name affected Windows builds.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":4503,"output_tokens":423,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-119868 for affected builds and the patch KB; sources here give only the NVD description.","search":"'-119868':14A,17A '-2026':13A,16A 'account':44B 'affect':51B 'allow':66C 'attack':31B,39B,69C 'author':30B,68C 'code':48B 'concurr':53C 'condit':4A,23B,62C 'cve':12A,15A 'elev':35B,71C 'execut':54C 'gain':9A 'higher':10A 'improp':59C 'infrastructur':18B 'kernel':2A,19B,27B,65C 'let':5A,28B 'local':7A,43B,73C 'machin':34B 'must':46B 'need':40B 'privileg':11A,37B,72C 'race':3A,22B,61C 'resourc':57C 'run':47B 'share':56C 'synchron':60C 'system':52B 'use':55C 'user':8A 'valid':42B 'window':1A,20B,26B,64C","nicknames":[],"mitigations":[],"who_affected":"Any Windows system where an untrusted or low-privilege user can run code locally is exposed. Systems where only administrators log in and no untrusted local users exist carry less practical risk. The sources do not name affected Windows builds.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","kernel","windows"],"campaign_type":null,"search_a":"'-119868':14A,17A '-2026':13A,16A 'condit':4A 'cve':12A,15A 'gain':9A 'higher':10A 'kernel':2A 'let':5A 'local':7A 'privileg':11A 'race':3A 'user':8A 'window':1A","search_b":"'account':44B 'affect':51B 'attack':31B,39B 'author':30B 'code':48B 'condit':23B 'elev':35B 'infrastructur':18B 'kernel':19B,27B 'let':28B 'local':43B 'machin':34B 'must':46B 'need':40B 'privileg':37B 'race':22B 'run':47B 'system':52B 'valid':42B 'window':20B,26B","search_c":"'allow':66C 'attack':69C 'author':68C 'concurr':53C 'condit':62C 'elev':71C 'execut':54C 'improp':59C 'kernel':65C 'local':73C 'privileg':72C 'race':61C 'resourc':57C 'share':56C 'synchron':60C 'use':55C 'window':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119868","severity":null,"published_at":"2026-11-10T19:20:05+00:00","modified_at":"2026-11-10T19:20:05+00:00","first_seen_at":"2026-11-10T19:25:00+00:00","fetched_at":"2026-11-10T19:25:00+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}