{"id":"CVE-2026-119899","kind":"vulnerability","aliases":["CVE-2026-119899"],"related":[],"title":"Windows Win32K: access control flaw lets a local user gain higher privileges","description":"Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.","summary":"Windows Win32K has an improper access control flaw that lets an authorized local attacker raise their privileges. The attacker needs an existing account on the machine and gets elevated rights on that system.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","win32k","windows"],"not_affected_if":["single-user-trusted-machines"],"how_to_check":"- Check the Windows build with `winver` and compare it to the fixed build in Microsoft's security update guide for CVE-2026-119899.\n- Confirm Windows Update has installed the latest cumulative update.","fix":null,"status":"open","published_at":"2026-11-10T19:20:10+00:00","first_seen_at":"2026-11-10T19:25:02+00:00","triaged_at":"2026-11-10T19:40:19+00:00","updated_at":"2026-11-10T19:40:19+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:40:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Win32K: access control flaw lets a local user gain higher privileges","impact":"high","summary":"Windows Win32K has an improper access control flaw that lets an authorized local attacker raise their privileges. The attacker needs an existing account on the machine and gets elevated rights on that system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","win32k"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user becomes administrator or SYSTEM on the machine","analyst_note":"Find the affected Windows builds and the Microsoft patch for CVE-2026-119899 in the Microsoft Security Response Center entry; the NVD record gives no version ranges.","how_to_check":"- Check the Windows build with `winver` and compare it to the fixed build in Microsoft's security update guide for CVE-2026-119899.\n- Confirm Windows Update has installed the latest cumulative update.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-user-trusted-machines"],"who_is_affected":"Any Windows machine where someone already has a local account can be exposed, since the flaw is triggered from the machine itself. Shared workstations, terminal servers and multi-user hosts carry the most risk. Systems where every user is fully trusted are lower priority but still need the patch.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000712,"input_tokens":4478,"output_tokens":528,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and the Microsoft patch for CVE-2026-119899 in the Microsoft Security Response Center entry; the NVD record gives no version ranges.","search":"'-119899':15A,18A '-2026':14A,17A 'access':3A,27B,56C 'account':44B 'allow':61C 'attack':35B,40B,64C 'author':33B,63C 'control':4A,28B,57C 'cve':13A,16A 'elev':50B,66C 'exist':43B 'flaw':5A,29B 'gain':10A 'get':49B 'higher':11A 'improp':26B,55C 'infrastructur':19B 'let':6A,31B 'local':8A,34B,68C 'machin':47B 'need':41B 'privileg':12A,38B,67C 'rais':36B 'right':51B 'system':54B 'user':9A 'win32k':2A,20B,23B,60C 'window':1A,21B,22B,59C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine where someone already has a local account can be exposed, since the flaw is triggered from the machine itself. Shared workstations, terminal servers and multi-user hosts carry the most risk. Systems where every user is fully trusted are lower priority but still need the patch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","win32k","windows"],"campaign_type":null,"search_a":"'-119899':15A,18A '-2026':14A,17A 'access':3A 'control':4A 'cve':13A,16A 'flaw':5A 'gain':10A 'higher':11A 'let':6A 'local':8A 'privileg':12A 'user':9A 'win32k':2A 'window':1A","search_b":"'access':27B 'account':44B 'attack':35B,40B 'author':33B 'control':28B 'elev':50B 'exist':43B 'flaw':29B 'get':49B 'improp':26B 'infrastructur':19B 'let':31B 'local':34B 'machin':47B 'need':41B 'privileg':38B 'rais':36B 'right':51B 'system':54B 'win32k':20B,23B 'window':21B,22B","search_c":"'access':56C 'allow':61C 'attack':64C 'author':63C 'control':57C 'elev':66C 'improp':55C 'local':68C 'privileg':67C 'win32k':60C 'window':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119899","severity":null,"published_at":"2026-11-10T19:20:10+00:00","modified_at":"2026-11-10T19:20:10+00:00","first_seen_at":"2026-11-10T19:25:02+00:00","fetched_at":"2026-11-10T19:25:02+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}