---
id: "CVE-2026-119914"
page: "https://infrastack.ai/live/CVE-2026-119914"
kind: "vulnerability"
aliases: ["CVE-2026-119914"]
title: "Windows Setup and Deployment: local privilege escalation via unrestricted communication channel"
severity: "medium"
cvss: 6.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "windows", "windows-deployment", "windows-setup"]
not_affected_if: ["unknown"]
published_at: "2026-11-10T19:20:12+00:00"
first_seen_at: "2026-11-10T19:25:02+00:00"
updated_at: "2026-11-10T19:55:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119914", "first_seen_at": "2026-11-10T19:25:02+00:00"}]
exploit_sources: []
---

# Windows Setup and Deployment: local privilege escalation via unrestricted communication channel

Link for people: https://infrastack.ai/live/CVE-2026-119914 (this .md is for agents)

Windows Setup and Deployment does not restrict its communication channel to the intended endpoints. An authorized local attacker can use this to elevate privileges on the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T19:25:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119914

## From the sources

Improper restriction of communication channel to intended endpoints in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_