{"id":"CVE-2026-88233","kind":"vulnerability","aliases":["CVE-2026-88233"],"related":[],"title":"Windows Task Scheduler: local user can gain elevated privileges","description":"Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.","summary":"Windows Task Scheduler has an authorization flaw that lets an already-logged-in attacker raise their privileges on the same machine. The sources give a CVSS score of 7.8 and do not describe the exact exploit path.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows","windows-server"],"not_affected_if":["no-local-user-access"],"how_to_check":"- Check the installed Windows build with `winver` and compare it with the patch level in Microsoft's advisory for CVE-2026-88233","fix":null,"status":"open","published_at":"2026-11-10T19:21:32+00:00","first_seen_at":"2026-11-10T19:25:20+00:00","triaged_at":"2026-11-10T19:38:39+00:00","updated_at":"2026-11-10T19:38:39+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:38:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Task Scheduler: local user can gain elevated privileges","impact":"high","summary":"Windows Task Scheduler has an authorization flaw that lets an already-logged-in attacker raise their privileges on the same machine. The sources give a CVSS score of 7.8 and do not describe the exact exploit path.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains higher privileges, possibly full control of the machine","analyst_note":"Find Microsoft's advisory for CVE-2026-88233 to confirm affected Windows builds, patched versions and any setting that limits exposure.","how_to_check":"- Check the installed Windows build with `winver` and compare it with the patch level in Microsoft's advisory for CVE-2026-88233\n- unknown for other checks: the sources do not say which file, setting or service configuration is affected","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-user-access"],"who_is_affected":"Only machines running Windows where a user already has a local account can be abused through this flaw. The sources do not name the affected Windows versions or the exact configuration needed, so teams should check Microsoft's advisory for those details.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4486,"output_tokens":510,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find Microsoft's advisory for CVE-2026-88233 to confirm affected Windows builds, patched versions and any setting that limits exposure.","search":"'-2026':11A,14A '-88233':12A,15A '7.8':50B 'allow':65C 'alreadi':32B 'already-logged-in':31B 'attack':35B,68C 'author':26B,60C,67C 'cve':10A,13A 'cvss':47B 'describ':54B 'elev':8A,70C 'exact':56B 'exploit':57B 'flaw':27B 'gain':7A 'give':45B 'improp':59C 'infrastructur':16B 'let':29B 'local':4A,72C 'log':33B 'machin':42B 'path':58B 'privileg':9A,38B,71C 'rais':36B 'schedul':3A,23B,64C 'score':48B 'server':20B 'sourc':44B 'task':2A,22B,63C 'user':5A 'window':1A,17B,19B,21B,62C 'windows-serv':18B","nicknames":[],"mitigations":[],"who_affected":"Only machines running Windows where a user already has a local account can be abused through this flaw. The sources do not name the affected Windows versions or the exact configuration needed, so teams should check Microsoft's advisory for those details.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows","windowsserver"],"campaign_type":null,"search_a":"'-2026':11A,14A '-88233':12A,15A 'cve':10A,13A 'elev':8A 'gain':7A 'local':4A 'privileg':9A 'schedul':3A 'task':2A 'user':5A 'window':1A","search_b":"'7.8':50B 'alreadi':32B 'already-logged-in':31B 'attack':35B 'author':26B 'cvss':47B 'describ':54B 'exact':56B 'exploit':57B 'flaw':27B 'give':45B 'infrastructur':16B 'let':29B 'log':33B 'machin':42B 'path':58B 'privileg':38B 'rais':36B 'schedul':23B 'score':48B 'server':20B 'sourc':44B 'task':22B 'window':17B,19B,21B 'windows-serv':18B","search_c":"'allow':65C 'attack':68C 'author':60C,67C 'elev':70C 'improp':59C 'local':72C 'privileg':71C 'schedul':64C 'task':63C 'window':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88233","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88233","severity":null,"published_at":"2026-11-10T19:21:32+00:00","modified_at":"2026-11-10T19:21:32+00:00","first_seen_at":"2026-11-10T19:25:20+00:00","fetched_at":"2026-11-10T19:25:20+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}