{"id":"CVE-2026-119939","kind":"vulnerability","aliases":["CVE-2026-119939"],"related":[],"title":"Windows Print Spooler: local user can gain elevated privileges","description":"Improper privilege management in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.","summary":"Windows Print Spooler components do not manage privileges correctly, so an authorized local user can raise their privileges. An attacker with a low-privilege account on the machine could end up with administrator-level control.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","print-spooler","windows"],"not_affected_if":["print-spooler-disabled"],"how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update for CVE-2026-119939\n- Check whether the Print Spooler service is running with `Get-Service Spooler`","fix":null,"status":"open","published_at":"2026-11-10T19:20:16+00:00","first_seen_at":"2026-11-10T19:25:04+00:00","triaged_at":"2026-11-10T19:40:10+00:00","updated_at":"2026-11-10T19:40:10+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:40:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Print Spooler: local user can gain elevated privileges","impact":"high","summary":"Windows Print Spooler components do not manage privileges correctly, so an authorized local user can raise their privileges. An attacker with a low-privilege account on the machine could end up with administrator-level control.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","print-spooler"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows machine","analyst_note":"Confirm affected Windows builds, fixed update and whether Print Spooler must be running, from the Microsoft advisory for CVE-2026-119939.","how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update for CVE-2026-119939\n- Check whether the Print Spooler service is running with `Get-Service Spooler`\n- unknown for other checks, as the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["print-spooler-disabled"],"who_is_affected":"Only machines running Windows with the Print Spooler service involved can be affected, and the attacker needs a local account first. The sources do not say which Windows builds are impacted, so check the vendor's advisory for affected versions. Systems where the Print Spooler service is disabled are likely outside the path, but this is not confirmed by the sources.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4486,"output_tokens":549,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Windows builds, fixed update and whether Print Spooler must be running, from the Microsoft advisory for CVE-2026-119939.","search":"'-119939':12A,15A '-2026':11A,14A 'account':46B 'administr':55B 'administrator-level':54B 'allow':66C 'attack':40B,69C 'author':32B,68C 'compon':24B,65C 'control':57B 'correct':29B 'could':50B 'cve':10A,13A 'elev':8A,71C 'end':51B 'gain':7A 'improp':58C 'infrastructur':16B 'level':56B 'local':4A,33B,73C 'low':44B 'low-privileg':43B 'machin':49B 'manag':27B,60C 'print':2A,18B,22B,63C 'print-spool':17B 'privileg':9A,28B,38B,45B,59C,72C 'rais':36B 'spooler':3A,19B,23B,64C 'user':5A,34B 'window':1A,20B,21B,62C","nicknames":[],"mitigations":[],"who_affected":"Only machines running Windows with the Print Spooler service involved can be affected, and the attacker needs a local account first. The sources do not say which Windows builds are impacted, so check the vendor's advisory for affected versions. Systems where the Print Spooler service is disabled are likely outside the path, but this is not confirmed by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","printspooler","windows"],"campaign_type":null,"search_a":"'-119939':12A,15A '-2026':11A,14A 'cve':10A,13A 'elev':8A 'gain':7A 'local':4A 'print':2A 'privileg':9A 'spooler':3A 'user':5A 'window':1A","search_b":"'account':46B 'administr':55B 'administrator-level':54B 'attack':40B 'author':32B 'compon':24B 'control':57B 'correct':29B 'could':50B 'end':51B 'infrastructur':16B 'level':56B 'local':33B 'low':44B 'low-privileg':43B 'machin':49B 'manag':27B 'print':18B,22B 'print-spool':17B 'privileg':28B,38B,45B 'rais':36B 'spooler':19B,23B 'user':34B 'window':20B,21B","search_c":"'allow':66C 'attack':69C 'author':68C 'compon':65C 'elev':71C 'improp':58C 'local':73C 'manag':60C 'print':63C 'privileg':59C,72C 'spooler':64C 'window':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119939","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119939","severity":null,"published_at":"2026-11-10T19:20:16+00:00","modified_at":"2026-11-10T19:20:16+00:00","first_seen_at":"2026-11-10T19:25:04+00:00","fetched_at":"2026-11-10T19:25:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}