{"id":"CVE-2026-124224","kind":"vulnerability","aliases":["CVE-2026-124224"],"related":[],"title":"Windows PowerShell: link following lets a local user gain privileges","description":"Improper link resolution before file access ('link following') in Windows PowerShell allows an authorized attacker to elevate privileges locally.","summary":"Windows PowerShell resolves a symbolic or file link before accessing a file, so a logged-in user can redirect that access. An authorized attacker on the machine can use this to elevate privileges.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607","fixed":["10.0.14393.9688"],"affected":">=10.0.14393.0, <10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows 10 1809","fixed":["10.0.17763.9487"],"affected":">=10.0.17763.0, <10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":">=10.0.19044.0, <10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">=10.0.19045.0, <10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">=10.0.22631.0, <10.0.22631.7711","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","powershell","self-hosted","windows"],"not_affected_if":["no-local-logins"],"how_to_check":"Run winver or [System.Environment]::OSVersion.Version and compare the full build number with the fixed build for your Windows version (per the CVE record via OffSeq, not yet confirmed on MSRC): Win10 1607 10.0.14393.9688; 1809 10.0.17763.9487; 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711. Other Windows versions are listed in the MSRC Security Update Guide for CVE-2026-124224. Note that Windows PowerShell 5.1 itself has the same version across builds, so compare the OS build, not $PSVersionTable.","fix":"Install the November 2026 Windows cumulative update that brings the OS to at least the fixed build for your version (e.g. 10.0.22631.7711 for Windows 11 23H2). KB numbers not yet read; see the MSRC page.","status":"open","published_at":"2026-11-10T19:20:48+00:00","first_seen_at":"2026-11-10T19:25:13+00:00","triaged_at":"2026-11-10T19:50:12+00:00","updated_at":"2026-11-10T21:27:42+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:50:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows PowerShell: link following lets a local user gain privileges","impact":"high","summary":"Windows PowerShell resolves a symbolic or file link before accessing a file, so a logged-in user can redirect that access. An authorized attacker on the machine can use this to elevate privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","powershell","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows machine","analyst_note":"Find the Microsoft advisory for CVE-2026-124224 to get affected Windows builds and the patch KB; the NVD entry gives no version ranges.","how_to_check":"- Check the installed Windows PowerShell version with `$PSVersionTable.PSVersion` and compare it with the fixed build in Microsoft's advisory.\n- Confirm the machine has the latest Windows cumulative update installed.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-logins"],"who_is_affected":"Any Windows machine running Windows PowerShell where a user with a local account can run code is a candidate. The sources do not name the affected builds, so treat every supported Windows version as in scope until the vendor advisory says otherwise. Systems where no one can log in locally are not exposed to this path.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000714,"input_tokens":4492,"output_tokens":530,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-124224 to get affected Windows builds and the patch KB; the NVD entry gives no version ranges.","search":"'-124224':13A,16A '-2026':12A,15A '10':18A,21A,24A,27A '11':30A '1607':19A '1809':22A '21h2':25A '22h2':28A '23h2':31A 'access':47B,59B,77C 'allow':83C 'attack':62B,86C 'author':61B,85C 'cve':11A,14A 'elev':70B,88C 'file':44B,49B,76C 'follow':4A,79C 'gain':9A 'host':36B 'improp':72C 'infrastructur':32B 'let':5A 'link':3A,45B,73C,78C 'local':7A,90C 'log':53B 'logged-in':52B 'machin':65B 'powershel':2A,33B,39B,82C 'privileg':10A,71B,89C 'redirect':57B 'resolut':74C 'resolv':40B 'self':35B 'self-host':34B 'symbol':42B 'use':67B 'user':8A,55B 'window':1A,37B,38B,81C 'windows':17A,20A,23A,26A,29A","nicknames":[],"mitigations":[],"who_affected":"Windows machines on the listed Windows 10 and Windows 11 builds, where a non-admin user can log in or run code locally (shared workstations, RDP/terminal servers, build agents, developer machines). The attacker needs a local account and the attack is rated high complexity. Machines where nobody untrusted can run code locally carry little risk, but should still be patched.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["101607","101809","1021h2","1022h2","1123h2","windows101607","windows101809","windows1021h2","windows1022h2","windows1123h2"],"ptokens":["10","11","1607","1809","21h2","22h2","23h2","windows"],"labels":["high","infrastructure","powershell","selfhosted","windows"],"campaign_type":null,"search_a":"'-124224':13A,16A '-2026':12A,15A '10':18A,21A,24A,27A '11':30A '1607':19A '1809':22A '21h2':25A '22h2':28A '23h2':31A 'cve':11A,14A 'follow':4A 'gain':9A 'let':5A 'link':3A 'local':7A 'powershel':2A 'privileg':10A 'user':8A 'window':1A 'windows':17A,20A,23A,26A,29A","search_b":"'access':47B,59B 'attack':62B 'author':61B 'elev':70B 'file':44B,49B 'host':36B 'infrastructur':32B 'link':45B 'log':53B 'logged-in':52B 'machin':65B 'powershel':33B,39B 'privileg':71B 'redirect':57B 'resolv':40B 'self':35B 'self-host':34B 'symbol':42B 'use':67B 'user':55B 'window':37B,38B","search_c":"'access':77C 'allow':83C 'attack':86C 'author':85C 'elev':88C 'file':76C 'follow':79C 'improp':72C 'link':73C,78C 'local':90C 'powershel':82C 'privileg':89C 'resolut':74C 'window':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124224","severity":null,"published_at":"2026-11-10T19:20:48+00:00","modified_at":"2026-11-10T19:20:48+00:00","first_seen_at":"2026-11-10T19:25:13+00:00","fetched_at":"2026-11-10T19:25:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124224:2796","url":"https://radar.offseq.com/threat/cve-2026-124224-cwe-59-link-following-in-microsoft-windows-10-version-1607-471327df5480d886","severity":null,"published_at":"2026-11-10T21:27:42+00:00","modified_at":"2026-11-10T21:27:42+00:00","first_seen_at":"2026-11-10T21:27:42+00:00","fetched_at":"2026-11-10T21:27:42+00:00","note":"MSRC page is JS-only (empty via web-cli), so nothing verified. Builds taken from OffSeq's mirror of the CVE record: 6 of 11 listed products (Win10 1607/1809/21H2/22H2, Win11 23H2); 5 more not shown, no KB numbers. Not exploited, no PoC (OffSeq, KEV false). Revisit once the MSRC page or KB list is readable.","cites":["https://radar.offseq.com/threat/cve-2026-124224-cwe-59-link-following-in-microsoft-windows-10-version-1607-471327df5480d886"]}],"documents":[{"id":118862,"url":"https://radar.offseq.com/threat/cve-2026-124224-cwe-59-link-following-in-microsoft-windows-10-version-1607-471327df5480d886","title":"OffSeq Threat Radar: CVE-2026-124224 (CVE record data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}