---
id: "CVE-2026-119899"
page: "https://infrastack.ai/live/CVE-2026-119899"
kind: "vulnerability"
aliases: ["CVE-2026-119899"]
title: "Windows Win32K: access control flaw lets a local user gain higher privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 10 1607 / Server 2016", "fixed": ["10.0.14393.9688"], "affected": ">= 10.0.14393.0, < 10.0.14393.9688", "ecosystem": "vendor"}, {"name": "Windows 10 1809 / Server 2019", "fixed": ["10.0.17763.9487"], "affected": ">= 10.0.17763.0, < 10.0.17763.9487", "ecosystem": "vendor"}, {"name": "Windows 10 21H2", "fixed": ["10.0.19044.7846"], "affected": ">= 10.0.19044.0, < 10.0.19044.7846", "ecosystem": "vendor"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": ">= 10.0.19045.0, < 10.0.19045.7846", "ecosystem": "vendor"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": ">= 10.0.22631.0, < 10.0.22631.7711", "ecosystem": "vendor"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": ">= 10.0.26100.0, < 10.0.26100.9974", "ecosystem": "vendor"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9974"], "affected": ">= 10.0.26200.0, < 10.0.26200.9974", "ecosystem": "vendor"}, {"name": "Windows 11 26H1", "fixed": ["10.0.28000.3501"], "affected": ">= 10.0.28000.0, < 10.0.28000.3501", "ecosystem": "vendor"}, {"name": "Windows 11 26H2", "fixed": ["10.0.26300.9974"], "affected": ">= 10.0.26300.0, < 10.0.26300.9974", "ecosystem": "vendor"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": ">= 10.0.20348.0, < 10.0.20348.5870", "ecosystem": "vendor"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": ">= 10.0.26100.0, < 10.0.26100.33822", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "local-privilege-escalation", "self-hosted", "win32k", "windows"]
not_affected_if: ["single-user-trusted-machines"]
published_at: "2026-11-10T19:20:10+00:00"
first_seen_at: "2026-11-10T19:25:02+00:00"
updated_at: "2026-11-10T22:26:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119899", "first_seen_at": "2026-11-10T19:25:02+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119899", "first_seen_at": "2026-11-10T22:26:27+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-119899", "https://app.opencve.io/cve/CVE-2026-119899"]}]
exploit_sources: []
---

# Windows Win32K: access control flaw lets a local user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-119899 (this .md is for agents)

Windows Win32K has an improper access control flaw that lets an authorized local attacker raise their privileges. The attacker needs an existing account on the machine and gets elevated rights on that system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows 10 1607 / Server 2016 affected >= 10.0.14393.0, < 10.0.14393.9688 fixed 10.0.14393.9688
- vendor:Windows 10 1809 / Server 2019 affected >= 10.0.17763.0, < 10.0.17763.9487 fixed 10.0.17763.9487
- vendor:Windows 10 21H2 affected >= 10.0.19044.0, < 10.0.19044.7846 fixed 10.0.19044.7846
- vendor:Windows 10 22H2 affected >= 10.0.19045.0, < 10.0.19045.7846 fixed 10.0.19045.7846
- vendor:Windows 11 23H2 affected >= 10.0.22631.0, < 10.0.22631.7711 fixed 10.0.22631.7711
- vendor:Windows 11 24H2 affected >= 10.0.26100.0, < 10.0.26100.9974 fixed 10.0.26100.9974
- vendor:Windows 11 25H2 affected >= 10.0.26200.0, < 10.0.26200.9974 fixed 10.0.26200.9974
- vendor:Windows 11 26H1 affected >= 10.0.28000.0, < 10.0.28000.3501 fixed 10.0.28000.3501
- vendor:Windows 11 26H2 affected >= 10.0.26300.0, < 10.0.26300.9974 fixed 10.0.26300.9974
- vendor:Windows Server 2022 affected >= 10.0.20348.0, < 10.0.20348.5870 fixed 10.0.20348.5870
- vendor:Windows Server 2025 affected >= 10.0.26100.0, < 10.0.26100.33822 fixed 10.0.26100.33822

## How to check

Run winver (or [Environment]::OSVersion / cmd 'ver') and compare the full build.revision with the fixed build for your Windows version listed in the fix. Lower than the fixed build means exposed. Also check Settings > Windows Update > Update history.

## Fix

Install the November 2026 Windows cumulative update that brings your build to at least: Win10 1607/Server 2016 10.0.14393.9688; Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. KB numbers: see MSRC entry.

## Timeline

- 2026-11-10T19:25:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119899
- 2026-11-10T22:26:27+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-119899 — MSRC page not fetchable (empty); build ranges taken from Microsoft CNA data in NVD/OpenCVE. Not exploited per Rapid7/KEV (not in KEV). Nothing marked verified since MSRC page unread; KB numbers unknown.

## Documents

- [describes] NVD CVE-2026-119899 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/CVE-2026-119899
- [mentions] OpenCVE CVE-2026-119899 (CNA version list) https://app.opencve.io/cve/CVE-2026-119899

## From the sources

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_