{"id":"CVE-2026-124226","kind":"vulnerability","aliases":["CVE-2026-124226"],"related":[],"title":"Microsoft PowerShell security feature bypass for local users (Windows 10, 11, Server)","description":"Execution with unnecessary privileges in Windows PowerShell allows an authorized attacker to bypass a security feature locally.","summary":"Windows PowerShell runs code with more privileges than it should, letting a signed-in attacker bypass a Windows security feature. The attacker needs an account on the machine first, and the flaw is only reachable locally.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10/11 and Windows Server","fixed":["10.0.26100.9968","10.0.26200.9968","10.0.22631.7711","10.0.19045.7846","10.0.20348.5870","10.0.26100.33812"],"affected":"below the Nov 2026 fixed build per version (e.g. Win11 24H2 < 10.0.26100.9968, Server 2022 < 10.0.20348.5870, Server 2025 < 10.0.26100.33812)","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","local","powershell","windows"],"not_affected_if":["no-local-accounts","patched-nov-2026"],"how_to_check":"Run 'winver' or PowerShell '[System.Environment]::OSVersion.Version' / 'Get-ComputerInfo OsBuildNumber' and compare the full build (e.g. 10.0.26100.xxxx) with the fixed build for your Windows version; lower means exposed.","fix":"Install the November 2026 cumulative update that brings the build to at least: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9968; 25H2 10.0.26200.9968; 26H1 10.0.28000.3501; 26H2 10.0.26300.9968; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33812. KB numbers not read.","status":"open","published_at":"2026-11-10T19:20:49+00:00","first_seen_at":"2026-11-10T19:25:13+00:00","triaged_at":"2026-11-10T19:26:14+00:00","updated_at":"2026-11-10T21:27:58+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:26:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows PowerShell: local attacker bypasses a security feature via privileges","impact":"medium","summary":"Windows PowerShell runs code with more privileges than it should, letting a signed-in attacker bypass a Windows security feature. The attacker needs an account on the machine first, and the flaw is only reachable locally.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","powershell"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker bypasses a Windows security feature with elevated privileges","analyst_note":"Confirm affected Windows builds and the fixed update from the Microsoft advisory linked from the NVD entry.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-accounts"],"who_is_affected":"Windows machines running Windows PowerShell where a user already has a local account. The sources do not name affected builds or whether the default configuration is exposed, so unknown beyond that.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":4493,"output_tokens":416,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Windows builds and the fixed update from the Microsoft advisory linked from the NVD entry.","search":"'-124226':15A,18A '-2026':14A,17A '10':10A '10/11':20A '11':11A 'account':53B 'allow':72C 'and':21A 'attack':43B,50B,75C 'author':74C 'bypass':5A,44B,77C 'code':31B 'cve':13A,16A 'execut':65C 'featur':4A,48B,80C 'first':57B 'flaw':60B 'infrastructur':24B 'let':38B 'local':7A,25B,64B,81C 'machin':56B 'microsoft':1A 'need':51B 'powershel':2A,26B,29B,71C 'privileg':34B,68C 'reachabl':63B 'run':30B 'secur':3A,47B,79C 'server':12A,23A 'sign':41B 'signed-in':40B 'unnecessari':67C 'user':8A 'window':9A,27B,28B,46B,70C 'windows':19A,22A","nicknames":[],"mitigations":[],"who_affected":"Windows 10, Windows 11 and Windows Server machines on a build below the November 2026 fixed build, where someone can already sign in locally (shared servers, RDP/terminal hosts, workstations with multiple users). Single-user machines with no untrusted local accounts or code carry less risk. Microsoft's CNA data lists the builds; the exact bypassed security feature is not stated in what was readable.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1011andwindowsserver","windows1011andwindowsserver"],"ptokens":["10","11","and","server","windows"],"labels":["high","infrastructure","local","powershell","windows"],"campaign_type":null,"search_a":"'-124226':15A,18A '-2026':14A,17A '10':10A '10/11':20A '11':11A 'and':21A 'bypass':5A 'cve':13A,16A 'featur':4A 'local':7A 'microsoft':1A 'powershel':2A 'secur':3A 'server':12A,23A 'user':8A 'window':9A 'windows':19A,22A","search_b":"'account':53B 'attack':43B,50B 'bypass':44B 'code':31B 'featur':48B 'first':57B 'flaw':60B 'infrastructur':24B 'let':38B 'local':25B,64B 'machin':56B 'need':51B 'powershel':26B,29B 'privileg':34B 'reachabl':63B 'run':30B 'secur':47B 'sign':41B 'signed-in':40B 'window':27B,28B,46B","search_c":"'allow':72C 'attack':75C 'author':74C 'bypass':77C 'execut':65C 'featur':80C 'local':81C 'powershel':71C 'privileg':68C 'secur':79C 'unnecessari':67C 'window':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124226","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124226","severity":null,"published_at":"2026-11-10T19:20:49+00:00","modified_at":"2026-11-10T19:20:49+00:00","first_seen_at":"2026-11-10T19:25:13+00:00","fetched_at":"2026-11-10T19:25:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124226:2794","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124226","severity":null,"published_at":"2026-11-10T21:27:58+00:00","modified_at":"2026-11-10T21:27:58+00:00","first_seen_at":"2026-11-10T21:27:58+00:00","fetched_at":"2026-11-10T21:27:58+00:00","note":"Affected builds and fixed builds taken from Microsoft CNA data via OpenCVE/NVD mirror; MSRC page is JS-only and did not render, so nothing marked verified. Not exploited per sources; no PoC found. KB numbers unknown.","cites":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124226","https://app.opencve.io/cve/CVE-2026-124226"]}],"documents":[{"id":118863,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124226","title":"MSRC: CVE-2026-124226 Microsoft PowerShell Security Feature Bypass Vulnerability (page did not render)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118864,"url":"https://app.opencve.io/cve/CVE-2026-124226","title":"OpenCVE: CVE-2026-124226 (Microsoft CNA affected builds)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}