{"id":"CVE-2026-88215","kind":"vulnerability","aliases":["CVE-2026-88215"],"related":[],"title":"Windows Filtering Platform: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally.","summary":"Windows Filtering Platform, the Windows networking filter component, has a use-after-free bug. An attacker with a local account can use it to elevate their privileges on the machine.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","self-hosted","windows"],"not_affected_if":["no-local-users"],"how_to_check":"- Check the installed Windows build against Microsoft's security update guide for CVE-2026-88215 (unknown: the sources do not list affected builds)\n- Confirm Windows Update reports the latest cumulative update as installed","fix":null,"status":"open","published_at":"2026-11-10T19:21:28+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","triaged_at":"2026-11-10T19:58:16+00:00","updated_at":"2026-11-10T19:58:16+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:58:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Filtering Platform: use-after-free lets a local user gain higher privileges","impact":"high","summary":"Windows Filtering Platform, the Windows networking filter component, has a use-after-free bug. An attacker with a local account can use it to elevate their privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the affected Windows builds and the fixed update in Microsoft's security update guide entry for CVE-2026-88215 (NVD link in the sources).","how_to_check":"- Check the installed Windows build against Microsoft's security update guide for CVE-2026-88215 (unknown: the sources do not list affected builds)\n- Confirm Windows Update reports the latest cumulative update as installed","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Affects Windows systems where a user already has a local, authorized account. The sources do not name the affected Windows builds. Remote attackers without a local account are not described as able to exploit it. Systems with no untrusted local users are lower priority.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4493,"output_tokens":504,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-88215':17A,20A 'account':46B 'allow':65C 'attack':42B,68C 'author':67C 'bug':40B 'compon':33B 'cve':15A,18A 'elev':51B,70C 'filter':2A,27B,32B,62C 'free':7A,39B,59C 'gain':12A 'higher':13A 'host':24B 'infrastructur':21B 'let':8A 'local':10A,45B,72C 'machin':56B 'network':31B 'platform':3A,28B,63C 'privileg':14A,53B,71C 'self':23B 'self-host':22B 'use':5A,37B,48B,57C 'use-after-fre':4A,36B 'user':11A 'wfp':64C 'window':1A,25B,26B,30B,61C","nicknames":[],"mitigations":[],"who_affected":"Affects Windows systems where a user already has a local, authorized account. The sources do not name the affected Windows builds. Remote attackers without a local account are not described as able to exploit it. Systems with no untrusted local users are lower priority.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","medium","selfhosted","windows"],"campaign_type":null,"search_a":"'-2026':16A,19A '-88215':17A,20A 'cve':15A,18A 'filter':2A 'free':7A 'gain':12A 'higher':13A 'let':8A 'local':10A 'platform':3A 'privileg':14A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A","search_b":"'account':46B 'attack':42B 'bug':40B 'compon':33B 'elev':51B 'filter':27B,32B 'free':39B 'host':24B 'infrastructur':21B 'local':45B 'machin':56B 'network':31B 'platform':28B 'privileg':53B 'self':23B 'self-host':22B 'use':37B,48B 'use-after-fre':36B 'window':25B,26B,30B","search_c":"'allow':65C 'attack':68C 'author':67C 'elev':70C 'filter':62C 'free':59C 'local':72C 'platform':63C 'privileg':71C 'use':57C 'wfp':64C 'window':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88215","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88215","severity":null,"published_at":"2026-11-10T19:21:28+00:00","modified_at":"2026-11-10T19:21:28+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","fetched_at":"2026-11-10T19:25:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}