{"id":"CVE-2026-119954","kind":"vulnerability","aliases":["CVE-2026-119954"],"related":[],"title":"Windows Search: absolute path traversal lets a local user gain higher privileges","description":"Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"A path traversal flaw in the Microsoft Windows Search Component lets an attacker who already has a local account read or write files outside the intended folders. That can be used to raise privileges on the same machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"10.0.17763.0 - < 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"10.0.19044.0 - < 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"10.0.19045.0 - < 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"10.0.22631.0 - < 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"10.0.26100.0 - < 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"10.0.26200.0 - < 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"10.0.28000.0 - < 10.0.28000.3501","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"10.0.26300.0 - < 10.0.26300.9974","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"10.0.20348.0 - < 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"10.0.26100.0 - < 10.0.26100.33822","ecosystem":"microsoft"}],"ecosystems":[],"tags":["endpoints","infrastructure","local","privilege-escalation","windows","windows-search"],"not_affected_if":["no-local-untrusted-users","patched-build"],"how_to_check":"Run winver (or PowerShell: [System.Environment]::OSVersion.Version, or (Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').UBR for the revision) and compare the full build number with the fixed builds in the fix field. Anything below it is affected. Windows Search is on by default on most editions; sc query WSearch shows whether it runs, but do not treat a stopped service as a safe state without Microsoft saying so.","fix":"Install the November 2026 Windows cumulative update for your version: Win10 1809/Server 2019 10.0.17763.9487, Win10 21H2 10.0.19044.7846, Win10 22H2 10.0.19045.7846, Win11 23H2 10.0.22631.7711, Win11 24H2 10.0.26100.9974, Win11 25H2 10.0.26200.9974, Win11 26H1 10.0.28000.3501, Win11 26H2 10.0.26300.9974, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822. KB numbers: see the MSRC entry.","status":"open","published_at":"2026-11-10T19:20:19+00:00","first_seen_at":"2026-11-10T19:25:04+00:00","triaged_at":"2026-11-10T19:40:06+00:00","updated_at":"2026-11-10T22:15:29+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:40:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Search: path traversal lets a local user gain higher privileges","impact":"high","summary":"A path traversal flaw in the Microsoft Windows Search Component lets an attacker who already has a local account read or write files outside the intended folders. That can be used to raise privileges on the same machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","endpoints"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains elevated privileges on the Windows machine","analyst_note":"Find the affected Windows builds and the Microsoft patch for CVE-2026-119954 in the Microsoft Security Update Guide; the NVD entry gives no version ranges.","how_to_check":"- Check the Windows build with `winver` and compare it against Microsoft's security update guide entry for CVE-2026-119954.\n- Confirm the Windows Search service is running with `sc query WSearch`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Affects Windows machines where the Windows Search Component is present and an attacker already has a local, authorized account. Exposure depends on the Windows version; the sources do not list affected builds or a fixed update. Systems without local untrusted users carry less risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":4493,"output_tokens":517,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and the Microsoft patch for CVE-2026-119954 in the Microsoft Security Update Guide; the NVD entry gives no version ranges.","search":"'-119954':15A,18A '-2026':14A,17A '10':20A,25A,28A '11':31A,34A,37A,40A,43A '1809':21A '2019':23A '2022':47A '2025':50A '21h2':26A '22h2':29A '23h2':32A '24h2':35A '25h2':38A '26h1':41A '26h2':44A 'absolut':3A,99C 'account':79B 'allow':107C 'alreadi':75B 'attack':73B,110C 'author':109C 'compon':70B,106C 'cve':13A,16A 'elev':112C 'endpoint':51B 'escal':56B 'file':83B 'flaw':64B 'folder':87B 'gain':10A 'higher':11A 'infrastructur':52B 'intend':86B 'let':6A,71B 'local':8A,53B,78B,114C 'machin':98B 'microsoft':67B,103C 'outsid':84B 'path':4A,62B,100C 'privileg':12A,55B,94B,113C 'privilege-escal':54B 'rais':93B 'read':80B 'search':2A,60B,69B,105C 'server':22A,46A,49A 'travers':5A,63B,101C 'use':91B 'user':9A 'window':1A,57B,59B,68B,104C 'windows':19A,24A,27A,30A,33A,36A,39A,42A,45A,48A 'windows-search':58B 'write':82B","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10, Windows 11 or Windows Server 2019/2022/2025 machine below the fixed build. The attacker needs an existing local, low-privilege account and no user interaction, so it matters most on shared machines, terminal servers, developer workstations and CI runners where untrusted code or users run. Single-user machines with no untrusted local code are lower priority, but patch in the normal cycle.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1809","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["endpoints","high","infrastructure","local","privilegeescalation","windows","windowssearch"],"campaign_type":null,"search_a":"'-119954':15A,18A '-2026':14A,17A '10':20A,25A,28A '11':31A,34A,37A,40A,43A '1809':21A '2019':23A '2022':47A '2025':50A '21h2':26A '22h2':29A '23h2':32A '24h2':35A '25h2':38A '26h1':41A '26h2':44A 'absolut':3A 'cve':13A,16A 'gain':10A 'higher':11A 'let':6A 'local':8A 'path':4A 'privileg':12A 'search':2A 'server':22A,46A,49A 'travers':5A 'user':9A 'window':1A 'windows':19A,24A,27A,30A,33A,36A,39A,42A,45A,48A","search_b":"'account':79B 'alreadi':75B 'attack':73B 'compon':70B 'endpoint':51B 'escal':56B 'file':83B 'flaw':64B 'folder':87B 'infrastructur':52B 'intend':86B 'let':71B 'local':53B,78B 'machin':98B 'microsoft':67B 'outsid':84B 'path':62B 'privileg':55B,94B 'privilege-escal':54B 'rais':93B 'read':80B 'search':60B,69B 'travers':63B 'use':91B 'window':57B,59B,68B 'windows-search':58B 'write':82B","search_c":"'absolut':99C 'allow':107C 'attack':110C 'author':109C 'compon':106C 'elev':112C 'local':114C 'microsoft':103C 'path':100C 'privileg':113C 'search':105C 'travers':101C 'window':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119954","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119954","severity":null,"published_at":"2026-11-10T19:20:19+00:00","modified_at":"2026-11-10T19:20:19+00:00","first_seen_at":"2026-11-10T19:25:04+00:00","fetched_at":"2026-11-10T19:25:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119954:2945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119954","severity":null,"published_at":"2026-11-10T22:15:29+00:00","modified_at":"2026-11-10T22:15:29+00:00","first_seen_at":"2026-11-10T22:15:29+00:00","fetched_at":"2026-11-10T22:15:29+00:00","note":"MSRC page is JS-only and unreadable; build ranges taken from Microsoft's CNA record as mirrored on NVD/OpenCVE. Not verified against MSRC itself; KB numbers unknown. No exploitation or PoC reported (not in KEV).","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-119954","https://app.opencve.io/cve/CVE-2026-119954"]}],"documents":[{"id":119426,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119954","title":"NVD CVE-2026-119954 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":119427,"url":"https://app.opencve.io/cve/CVE-2026-119954","title":"OpenCVE CVE-2026-119954","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}