{"id":"CVE-2026-119988","kind":"vulnerability","aliases":["CVE-2026-119988"],"related":[],"title":"Windows SMB: numeric truncation lets an authenticated user run code over the network (patched Nov 2026)","description":"Numeric truncation error in Windows SMB allows an authorized attacker to execute code over a network.","summary":"Microsoft's November 10, 2026 Patch Tuesday fixes a Windows SMB remote code execution flaw (CWE-197, numeric truncation), CVSS 7.1 per MSRC via an aggregator. Vector AV:N/AC:H/PR:L/UI:R: needs low privileges, high complexity and user interaction. CISA SSVC shows no exploitation observed. I could not read the MSRC or NVD pages, so the details come from an aggregator.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-sharing","infrastructure","smb","smb-server","windows"],"not_affected_if":[],"how_to_check":"Check the installed build against the November 2026 cumulative update for your Windows version, for example with winver or Get-HotFix. Examples listed by the aggregator: Server 2019 KB5131085 (build 17763.9487), Windows 11 23H2 KB5131087 (22631.7711), Server 2022 KB5131090 (20348.5870), Windows 11 24H2 KB5132061 (26100.9974), Windows 10 1607 KB5131291 (14393.9688). Confirm against MSRC before relying on these.","fix":"Install the November 10, 2026 cumulative update for your Windows version (KBs listed under how-to-check). Not confirmed on the MSRC page.","status":"open","published_at":"2026-11-10T19:20:23+00:00","first_seen_at":"2026-11-10T19:25:06+00:00","triaged_at":"2026-11-10T19:47:56+00:00","updated_at":"2026-11-10T22:10:13+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:47:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows SMB: numeric truncation lets an authorized user run code remotely","impact":"high","summary":"A numeric truncation error in the Windows SMB file-sharing service lets an attacker who already has valid access run code over the network. The sources give no further detail on the trigger or affected builds.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","smb","file-sharing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker runs code on the Windows server over the network","analyst_note":"Check the NVD entry and Microsoft's security update guide for CVE-2026-119988 for affected Windows builds, fixed patches and any mitigation.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running the Windows SMB file-sharing service, reachable from a network where authorized users connect. The sources do not list affected Windows builds or the exact configuration needed. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000653,"input_tokens":4478,"output_tokens":411,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Microsoft's security update guide for CVE-2026-119988 for affected Windows builds, fixed patches and any mitigation.","search":"'-119988':19A,22A '-197':48B '-2026':18A,21A '10':35B '2026':16A,36B '7.1':52B 'aggreg':57B,93B 'allow':100C 'attack':103C 'authent':7A 'author':102C 'av':59B 'cisa':72B 'code':10A,44B,106C 'come':90B 'complex':68B 'could':79B 'cve':17A,20A 'cvss':51B 'cwe':47B 'detail':89B 'error':96C 'execut':45B,105C 'exploit':76B 'file':24B 'file-shar':23B 'fix':39B 'flaw':46B 'h/pr':61B 'high':67B 'infrastructur':26B 'interact':71B 'l/ui':62B 'let':5A 'low':65B 'microsoft':32B 'msrc':54B,83B 'n/ac':60B 'need':64B 'network':13A,109C 'nov':15A 'novemb':34B 'numer':3A,49B,94C 'nvd':85B 'observ':77B 'page':86B 'patch':14A,37B 'per':53B 'privileg':66B 'r':63B 'read':81B 'remot':43B 'run':9A 'server':30B 'share':25B 'show':74B 'smb':2A,27B,29B,42B,99C 'smb-server':28B 'ssvc':73B 'truncat':4A,50B,95C 'tuesday':38B 'user':8A,70B 'vector':58B 'via':55B 'window':1A,31B,41B,98C","nicknames":[],"mitigations":[],"who_affected":"Windows clients and servers (Windows 10, 11 and Server) that have not installed the November 2026 cumulative update. An attacker needs valid low-privilege access, and per the CVSS vector some user interaction. Aggregator lists show 42 affected version entries, and I could not read the full list. Fully patched systems can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["filesharing","high","infrastructure","smb","smbserver","windows"],"campaign_type":null,"search_a":"'-119988':19A,22A '-2026':18A,21A '2026':16A 'authent':7A 'code':10A 'cve':17A,20A 'let':5A 'network':13A 'nov':15A 'numer':3A 'patch':14A 'run':9A 'smb':2A 'truncat':4A 'user':8A 'window':1A","search_b":"'-197':48B '10':35B '2026':36B '7.1':52B 'aggreg':57B,93B 'av':59B 'cisa':72B 'code':44B 'come':90B 'complex':68B 'could':79B 'cvss':51B 'cwe':47B 'detail':89B 'execut':45B 'exploit':76B 'file':24B 'file-shar':23B 'fix':39B 'flaw':46B 'h/pr':61B 'high':67B 'infrastructur':26B 'interact':71B 'l/ui':62B 'low':65B 'microsoft':32B 'msrc':54B,83B 'n/ac':60B 'need':64B 'novemb':34B 'numer':49B 'nvd':85B 'observ':77B 'page':86B 'patch':37B 'per':53B 'privileg':66B 'r':63B 'read':81B 'remot':43B 'server':30B 'share':25B 'show':74B 'smb':27B,29B,42B 'smb-server':28B 'ssvc':73B 'truncat':50B 'tuesday':38B 'user':70B 'vector':58B 'via':55B 'window':31B,41B","search_c":"'allow':100C 'attack':103C 'author':102C 'code':106C 'error':96C 'execut':105C 'network':109C 'numer':94C 'smb':99C 'truncat':95C 'window':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119988","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119988","severity":null,"published_at":"2026-11-10T19:20:23+00:00","modified_at":"2026-11-10T19:20:24+00:00","first_seen_at":"2026-11-10T19:25:06+00:00","fetched_at":"2026-11-10T19:25:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119988:2929","url":"https://notcve.org/cve/CVE-2026-119988","severity":null,"published_at":"2026-11-10T22:10:13+00:00","modified_at":"2026-11-10T22:10:13+00:00","first_seen_at":"2026-11-10T22:10:13+00:00","fetched_at":"2026-11-10T22:10:13+00:00","note":"MSRC/NVD pages returned empty (JS-only). Details are from the notcve.org aggregator only. Nothing verified. No mitigations, PoC or exploitation found. Re-check MSRC for the full affected list and any workaround.","cites":["https://notcve.org/cve/CVE-2026-119988"]}],"documents":[{"id":119404,"url":"https://notcve.org/cve/CVE-2026-119988","title":"NotCVE: CVE-2026-119988 Windows SMB RCE (aggregator of MSRC data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}