{"id":"CVE-2026-40626","kind":"vulnerability","aliases":["CVE-2026-40626"],"related":[],"title":"Intel Wireless Bluetooth for Windows: search path lets local user escalate privileges","description":"Uncontrolled search path for some Intel(R) Wireless Bluetooth(R) software for Windows within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","summary":"Some Intel Wireless Bluetooth software for Windows loads code from an uncontrolled search path when run from a user application. A local user with an account can use this to gain higher privileges on the machine.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["intel-bluetooth","vendor","windows"],"not_affected_if":["no-intel-bluetooth-software"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T18:17:38+00:00","first_seen_at":"2026-11-10T18:22:57+00:00","triaged_at":"2026-11-10T18:25:13+00:00","updated_at":"2026-11-10T18:25:13+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T18:25:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Intel Wireless Bluetooth for Windows: search path lets local user escalate privileges","impact":"high","summary":"Some Intel Wireless Bluetooth software for Windows loads code from an uncontrolled search path when run from a user application. A local user with an account can use this to gain higher privileges on the machine.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["windows","intel-bluetooth"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher privileges and full control of the machine","analyst_note":"Find Intel's security advisory for this CVE to get affected and fixed Intel Wireless Bluetooth versions and the vendor's remediation.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-intel-bluetooth-software"],"who_is_affected":"Windows machines with Intel Wireless Bluetooth software installed are the systems to look at; the sources do not list affected driver or software versions. An attacker needs a local user account and active user interaction, and the flaw is not reachable from the network. unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000693,"input_tokens":4666,"output_tokens":452,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-40626':15A,18A '3':75C 'access':109C 'account':49B 'activ':121C 'adversari':86C 'allow':79C 'applic':43B,77C 'attack':96C,111C 'authent':89C 'avail':135C,150C 'bluetooth':3A,21B,27B,68C 'code':32B 'combin':91C 'complex':95C 'confidenti':130C,145C 'cve':13A,16A 'enabl':98C 'escal':11A,81C,99C 'gain':54B 'high':94C,131C,133C,136C 'higher':55B 'impact':128C,152C 'integr':132C,147C 'intel':1A,20B,25B,65C 'intel-bluetooth':19B 'interact':123C 'intern':117C 'knowledg':118C 'let':8A 'load':31B 'local':9A,45B,108C 'machin':59B 'may':78C,97C,104C,127C 'none':146C,148C,151C 'occur':106C 'path':7A,37B,62C 'potenti':105C,125C 'present':114C 'privileg':12A,56B,83C,101C 'r':66C,69C 'requir':112C,120C 'result':103C,141C 'ring':74C 'run':39B 'search':6A,36B,61C 'softwar':28B,70C,85C 'special':116C 'subsequ':143C 'system':140C,144C 'uncontrol':35B,60C 'unprivileg':84C 'use':51B 'user':10A,42B,46B,76C,90C,122C 'vendor':22B 'via':107C 'vulner':126C,139C 'window':5A,23B,30B,72C 'wireless':2A,26B,67C 'within':73C 'without':115C","nicknames":[],"mitigations":[],"who_affected":"Windows machines with Intel Wireless Bluetooth software installed are the systems to look at; the sources do not list affected driver or software versions. An attacker needs a local user account and active user interaction, and the flaw is not reachable from the network. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["intelbluetooth","medium","vendor","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-40626':15A,18A 'bluetooth':3A 'cve':13A,16A 'escal':11A 'intel':1A 'let':8A 'local':9A 'path':7A 'privileg':12A 'search':6A 'user':10A 'window':5A 'wireless':2A","search_b":"'account':49B 'applic':43B 'bluetooth':21B,27B 'code':32B 'gain':54B 'higher':55B 'intel':20B,25B 'intel-bluetooth':19B 'load':31B 'local':45B 'machin':59B 'path':37B 'privileg':56B 'run':39B 'search':36B 'softwar':28B 'uncontrol':35B 'use':51B 'user':42B,46B 'vendor':22B 'window':23B,30B 'wireless':26B","search_c":"'3':75C 'access':109C 'activ':121C 'adversari':86C 'allow':79C 'applic':77C 'attack':96C,111C 'authent':89C 'avail':135C,150C 'bluetooth':68C 'combin':91C 'complex':95C 'confidenti':130C,145C 'enabl':98C 'escal':81C,99C 'high':94C,131C,133C,136C 'impact':128C,152C 'integr':132C,147C 'intel':65C 'interact':123C 'intern':117C 'knowledg':118C 'local':108C 'may':78C,97C,104C,127C 'none':146C,148C,151C 'occur':106C 'path':62C 'potenti':105C,125C 'present':114C 'privileg':83C,101C 'r':66C,69C 'requir':112C,120C 'result':103C,141C 'ring':74C 'search':61C 'softwar':70C,85C 'special':116C 'subsequ':143C 'system':140C,144C 'uncontrol':60C 'unprivileg':84C 'user':76C,90C,122C 'via':107C 'vulner':126C,139C 'window':72C 'wireless':67C 'within':73C 'without':115C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-40626","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40626","severity":null,"published_at":"2026-11-10T18:17:38+00:00","modified_at":"2026-11-10T18:17:38+00:00","first_seen_at":"2026-11-10T18:22:57+00:00","fetched_at":"2026-11-10T18:22:57+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}