{"id":"CVE-2026-119961","kind":"vulnerability","aliases":["CVE-2026-119961"],"related":[],"title":"Windows IIS: race condition lets an unauthorized attacker run code remotely","description":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.","summary":"A race condition in Windows Internet Information Services (IIS) lets an attacker execute code over the network. The sources give no further detail on the exact trigger.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607","fixed":["10.0.14393.9688"],"affected":">= 10.0.14393.0, < 10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 10 1809","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":">= 10.0.19044.0, < 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">= 10.0.22631.0, < 10.0.22631.7711","ecosystem":"microsoft"}],"ecosystems":[],"tags":["iis","infrastructure","windows","windows-server"],"not_affected_if":["iis-not-installed"],"how_to_check":"Run winver or [System.Environment]::OSVersion.Version to get the build and compare with the fixed builds. Check IIS is installed: Get-WindowsFeature Web-Server (Server) or Get-WindowsOptionalFeature -Online -FeatureName IIS-WebServer (client). Hosts without IIS can skip. Confirm the full product list in the MSRC guide for CVE-2026-119961.","fix":"Install the November 2026 (10 Nov) Windows cumulative update. Fixed builds listed by a mirror of Microsoft's record: Win10 1607 10.0.14393.9688, Win10 1809 10.0.17763.9487, Win10 21H2 10.0.19044.7846, Win10 22H2 10.0.19045.7846, Win11 23H2 10.0.22631.7711; further products truncated. Confirm your build in the MSRC Security Update Guide.","status":"open","published_at":"2026-11-10T19:20:20+00:00","first_seen_at":"2026-11-10T19:25:05+00:00","triaged_at":"2026-11-10T19:34:43+00:00","updated_at":"2026-11-10T22:13:21+00:00","category":"infrastructure","confidence":0.55,"triage":{"at":"2026-11-10T19:34:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows IIS: race condition lets an unauthorized attacker run code remotely","impact":"high","summary":"A race condition in Windows Internet Information Services (IIS) lets an attacker execute code over the network. The sources give no further detail on the exact trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["iis","windows","windows-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the IIS server over the network.","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119961 for affected IIS versions, the fixed update and any non-default requirement.","how_to_check":"- Check the Windows build and IIS presence with `Get-WindowsFeature Web-Server` on Windows Server, or confirm the IIS role is installed in Server Manager.\n- Compare the installed cumulative update against the Microsoft security update guide entry for CVE-2026-119961.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running Microsoft Internet Information Services on Windows are the ones to look at. The sources do not say which IIS versions, configurations or roles are affected, so unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":4503,"output_tokens":495,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119961 for affected IIS versions, the fixed update and any non-default requirement.","search":"'-119961':14A,17A '-2026':13A,16A '10':19A,22A,25A,28A '11':31A '1607':20A '1809':23A '21h2':26A '22h2':29A '23h2':32A 'allow':81C 'attack':8A,50B,84C 'code':10A,52B,87C 'concurr':66C 'condit':4A,41B,75C 'cve':12A,15A 'detail':61B 'exact':64B 'execut':51B,67C,86C 'give':58B 'ii':2A,33B,47B 'improp':72C 'inform':45B,79C 'infrastructur':34B 'internet':44B,78C 'let':5A,48B 'network':55B,90C 'race':3A,40B,74C 'remot':11A 'resourc':70C 'run':9A 'server':38B 'servic':46B,80C 'share':69C 'sourc':57B 'synchron':73C 'trigger':65B 'unauthor':7A,83C 'use':68C 'window':1A,35B,37B,43B,77C 'windows':18A,21A,24A,27A,30A 'windows-serv':36B","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the IIS role or feature enabled and reachable over the network are exposed; the attack needs no login but is rated high complexity (race condition). Look at Windows Server and Windows client hosts running IIS sites. Hosts without IIS can skip it. More affected Windows versions exist than listed here (the source list was truncated).","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607","101809","1021h2","1022h2","1123h2","windows101607","windows101809","windows1021h2","windows1022h2","windows1123h2"],"ptokens":["10","11","1607","1809","21h2","22h2","23h2","windows"],"labels":["high","iis","infrastructure","windows","windowsserver"],"campaign_type":null,"search_a":"'-119961':14A,17A '-2026':13A,16A '10':19A,22A,25A,28A '11':31A '1607':20A '1809':23A '21h2':26A '22h2':29A '23h2':32A 'attack':8A 'code':10A 'condit':4A 'cve':12A,15A 'ii':2A 'let':5A 'race':3A 'remot':11A 'run':9A 'unauthor':7A 'window':1A 'windows':18A,21A,24A,27A,30A","search_b":"'attack':50B 'code':52B 'condit':41B 'detail':61B 'exact':64B 'execut':51B 'give':58B 'ii':33B,47B 'inform':45B 'infrastructur':34B 'internet':44B 'let':48B 'network':55B 'race':40B 'server':38B 'servic':46B 'sourc':57B 'trigger':65B 'window':35B,37B,43B 'windows-serv':36B","search_c":"'allow':81C 'attack':84C 'code':87C 'concurr':66C 'condit':75C 'execut':67C,86C 'improp':72C 'inform':79C 'internet':78C 'network':90C 'race':74C 'resourc':70C 'servic':80C 'share':69C 'synchron':73C 'unauthor':83C 'use':68C 'window':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119961","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119961","severity":null,"published_at":"2026-11-10T19:20:20+00:00","modified_at":"2026-11-10T19:20:20+00:00","first_seen_at":"2026-11-10T19:25:05+00:00","fetched_at":"2026-11-10T19:25:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119961:2942","url":"https://radar.offseq.com/threat/cve-2026-119961-cwe-362-race-condition-in-microsoft-windows-10-version-1607-75e9a667251ac4b9","severity":null,"published_at":"2026-11-10T22:13:21+00:00","modified_at":"2026-11-10T22:13:21+00:00","first_seen_at":"2026-11-10T22:13:21+00:00","fetched_at":"2026-11-10T22:13:21+00:00","note":"MSRC page is JS-only and unreadable here; NVD page empty. Affected builds and fixed builds come from an OffSeq mirror of Microsoft's CVE record (list truncated, +8 more products), so nothing is marked verified. No exploitation or PoC found; not in KEV.","cites":["https://radar.offseq.com/threat/cve-2026-119961-cwe-362-race-condition-in-microsoft-windows-10-version-1607-75e9a667251ac4b9"]}],"documents":[{"id":119423,"url":"https://radar.offseq.com/threat/cve-2026-119961-cwe-362-race-condition-in-microsoft-windows-10-version-1607-75e9a667251ac4b9","title":"OffSeq: CVE-2026-119961 (mirrors Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}