{"id":"CVE-2026-119947","kind":"vulnerability","aliases":["CVE-2026-119947"],"related":[],"title":"Windows Hyper-V: use-after-free lets an authorized user gain higher privileges","description":"Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in Windows Hyper-V lets an attacker who already has an account on the machine elevate their privileges. The attacker needs local access and valid credentials first.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"microsoft"}],"ecosystems":[],"tags":["hyper-v","infrastructure","local-privilege-escalation","windows","windows-server"],"not_affected_if":["hyper-v-not-enabled"],"how_to_check":"Run winver or [Environment]::OSVersion / (Get-ComputerInfo).OsBuildRevision and compare the build with the fixed builds in the fix field. Then see whether the Hyper-V role is on: Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V. Hosts without Hyper-V enabled are likely not exposed, but the Microsoft page was not readable to confirm that.","fix":"Install the November 2026 Windows cumulative update that brings the build to at least: Win10 1607/Server 2016 10.0.14393.9688; Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822.","status":"open","published_at":"2026-11-10T19:20:18+00:00","first_seen_at":"2026-11-10T19:25:04+00:00","triaged_at":"2026-11-10T19:44:30+00:00","updated_at":"2026-11-10T22:17:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:44:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Hyper-V: use-after-free lets an authorized user gain higher privileges","impact":"high","summary":"A use-after-free bug in Windows Hyper-V lets an attacker who already has an account on the machine elevate their privileges. The attacker needs local access and valid credentials first.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","hyper-v"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains elevated system privileges on the host","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119947 for affected builds, required Hyper-V configuration and the patch.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["hyper-v-not-enabled"],"who_is_affected":"Systems running Windows with the Hyper-V role enabled are the ones in scope, since the flaw is in Hyper-V. The sources do not say which Windows builds or configurations are affected, so unknown. Machines without Hyper-V enabled are likely not exposed, but the sources do not confirm this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":4480,"output_tokens":461,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119947 for affected builds, required Hyper-V configuration and the patch.","search":"'-119947':18A,21A '-2026':17A,20A '10':44A,47A '11':35A,38A,41A '2016':33A '2019':30A '2022':27A '2025':24A '21h2':48A '22h2':45A '23h2':42A '24h2':36A '25h2':39A 'access':90B 'account':79B 'allow':103C 'alreadi':76B 'attack':74B,87B,106C 'author':11A,105C 'bug':66B 'credenti':93B 'cve':16A,19A 'elev':83B,108C 'escal':56B 'first':94B 'free':8A,65B,97C 'gain':13A 'higher':14A 'hyper':3A,50B,70B,101C 'hyper-v':2A,49B,69B,100C 'infrastructur':52B 'let':9A,72B 'local':54B,89B,110C 'local-privilege-escal':53B 'machin':82B 'need':88B 'privileg':15A,55B,85B,109C 'server':23A,26A,29A,32A,60B 'use':6A,63B,95C 'use-after-fre':5A,62B 'user':12A 'v':4A,51B,71B,102C 'valid':92B 'window':1A,57B,59B,68B,99C 'windows':22A,25A,28A,31A,34A,37A,40A,43A,46A 'windows-serv':58B","nicknames":[],"mitigations":[],"who_affected":"Windows 10, Windows 11 and Windows Server 2016, 2019, 2022 and 2025 builds older than the November 2026 fixed builds are listed as affected. The attacker must already be on the machine with high privileges (CVSS PR:H, AV:L, AC:H), so the risk is mainly to Hyper-V hosts where several admins or tenants share the machine. Machines without Hyper-V enabled likely can skip it, which the Microsoft page could not confirm.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1021h2","1022h2","1123h2","1124h2","1125h2","server2016","server2019","server2022","server2025","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windowsserver2016","windowsserver2019","windowsserver2022","windowsserver2025"],"ptokens":["10","11","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","server","windows"],"labels":["high","hyperv","infrastructure","localprivilegeescalation","windows","windowsserver"],"campaign_type":null,"search_a":"'-119947':18A,21A '-2026':17A,20A '10':44A,47A '11':35A,38A,41A '2016':33A '2019':30A '2022':27A '2025':24A '21h2':48A '22h2':45A '23h2':42A '24h2':36A '25h2':39A 'author':11A 'cve':16A,19A 'free':8A 'gain':13A 'higher':14A 'hyper':3A 'hyper-v':2A 'let':9A 'privileg':15A 'server':23A,26A,29A,32A 'use':6A 'use-after-fre':5A 'user':12A 'v':4A 'window':1A 'windows':22A,25A,28A,31A,34A,37A,40A,43A,46A","search_b":"'access':90B 'account':79B 'alreadi':76B 'attack':74B,87B 'bug':66B 'credenti':93B 'elev':83B 'escal':56B 'first':94B 'free':65B 'hyper':50B,70B 'hyper-v':49B,69B 'infrastructur':52B 'let':72B 'local':54B,89B 'local-privilege-escal':53B 'machin':82B 'need':88B 'privileg':55B,85B 'server':60B 'use':63B 'use-after-fre':62B 'v':51B,71B 'valid':92B 'window':57B,59B,68B 'windows-serv':58B","search_c":"'allow':103C 'attack':106C 'author':105C 'elev':108C 'free':97C 'hyper':101C 'hyper-v':100C 'local':110C 'privileg':109C 'use':95C 'v':102C 'window':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119947","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119947","severity":null,"published_at":"2026-11-10T19:20:18+00:00","modified_at":"2026-11-10T19:20:18+00:00","first_seen_at":"2026-11-10T19:25:04+00:00","fetched_at":"2026-11-10T19:25:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119947:2951","url":"https://app.opencve.io/cve/CVE-2026-119947","severity":null,"published_at":"2026-11-10T22:17:51+00:00","modified_at":"2026-11-10T22:17:51+00:00","first_seen_at":"2026-11-10T22:17:51+00:00","fetched_at":"2026-11-10T22:17:51+00:00","note":"MSRC page is JS-only and unreadable here; affected/fixed builds taken from the Microsoft CNA record as mirrored by OpenCVE (not the vendor page), so nothing marked verified. Re-check on MSRC for the KB numbers and any Hyper-V-role condition. Not exploited, no PoC found.","cites":["https://app.opencve.io/cve/CVE-2026-119947","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119947"]}],"documents":[{"id":119443,"url":"https://app.opencve.io/cve/CVE-2026-119947","title":"OpenCVE: CVE-2026-119947 (mirrors Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":119446,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119947","title":"MSRC Security Update Guide: CVE-2026-119947 (JS-only, text not readable)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}