{"id":"CVE-2026-70182","kind":"vulnerability","aliases":["CVE-2026-70182"],"related":[],"title":"Windows Bind Filter Driver: weak authentication lets a local user gain higher privileges","description":"Weak authentication in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.","summary":"The Windows Bind Filter Driver has weak authentication, so a user already authorized on the machine can elevate their privileges. An attacker who has a local account can gain higher rights on that Windows system.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:20+00:00","first_seen_at":"2026-11-10T19:25:17+00:00","triaged_at":"2026-11-10T19:38:49+00:00","updated_at":"2026-11-10T19:38:49+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Bind Filter Driver: weak authentication lets a local user gain higher privileges","impact":"high","summary":"The Windows Bind Filter Driver has weak authentication, so a user already authorized on the machine can elevate their privileges. An attacker who has a local account can gain higher rights on that Windows system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows machine","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds, the fixed version, and whether the Bind Filter Driver is enabled by default.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Affects Windows systems with the Bind Filter Driver present; the sources do not say which Windows versions or configurations are affected. Exposure requires an attacker who already has an authorized local account, so systems without untrusted local users carry lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000673,"input_tokens":4490,"output_tokens":447,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds, the fixed version, and whether the Bind Filter Driver is enabled by default.","search":"'-2026':15A,18A '-70182':16A,19A 'account':48B 'allow':64C 'alreadi':33B 'attack':43B,67C 'authent':6A,29B,58C 'author':34B,66C 'bind':2A,24B,61C 'cve':14A,17A 'driver':4A,26B,63C 'elev':39B,69C 'filter':3A,25B,62C 'gain':11A,50B 'higher':12A,51B 'infrastructur':20B 'let':7A 'local':9A,47B,71C 'machin':37B 'privileg':13A,41B,70C 'right':52B 'system':56B 'user':10A,32B 'weak':5A,28B,57C 'window':1A,21B,23B,55B,60C","nicknames":[],"mitigations":[],"who_affected":"Affects Windows systems with the Bind Filter Driver present; the sources do not say which Windows versions or configurations are affected. Exposure requires an attacker who already has an authorized local account, so systems without untrusted local users carry lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows"],"campaign_type":null,"search_a":"'-2026':15A,18A '-70182':16A,19A 'authent':6A 'bind':2A 'cve':14A,17A 'driver':4A 'filter':3A 'gain':11A 'higher':12A 'let':7A 'local':9A 'privileg':13A 'user':10A 'weak':5A 'window':1A","search_b":"'account':48B 'alreadi':33B 'attack':43B 'authent':29B 'author':34B 'bind':24B 'driver':26B 'elev':39B 'filter':25B 'gain':50B 'higher':51B 'infrastructur':20B 'local':47B 'machin':37B 'privileg':41B 'right':52B 'system':56B 'user':32B 'weak':28B 'window':21B,23B,55B","search_c":"'allow':64C 'attack':67C 'authent':58C 'author':66C 'bind':61C 'driver':63C 'elev':69C 'filter':62C 'local':71C 'privileg':70C 'weak':57C 'window':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-70182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70182","severity":null,"published_at":"2026-11-10T19:21:20+00:00","modified_at":"2026-11-10T19:21:20+00:00","first_seen_at":"2026-11-10T19:25:17+00:00","fetched_at":"2026-11-10T19:25:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}