---
id: "CVE-2026-88235"
page: "https://infrastack.ai/live/CVE-2026-88235"
kind: "vulnerability"
aliases: ["CVE-2026-88235"]
title: "Windows Servicing Stack Updates: confused deputy lets a local user gain privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "local", "privilege-escalation", "servicing-stack-update", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:21:32+00:00"
first_seen_at: "2026-11-10T19:25:20+00:00"
updated_at: "2026-11-10T20:43:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88235", "first_seen_at": "2026-11-10T19:25:20+00:00"}, {"source": "analyst", "url": "https://api.msrc.microsoft.com/cvrf/v3.0/updates/CVE-2026-88235", "first_seen_at": "2026-11-10T20:43:19+00:00", "cites": ["https://api.msrc.microsoft.com/cvrf/v3.0/updates/CVE-2026-88235"]}]
exploit_sources: []
---

# Windows Servicing Stack Updates: confused deputy lets a local user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-88235 (this .md is for agents)

Microsoft's Servicing Stack Updates component can be made to act as an unintended intermediary, a confused deputy. An authorized local attacker can use it to elevate their privileges on the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Unknown: Microsoft's advisory page needs JavaScript and was not readable. Open the Security Update Guide entry for CVE-2026-88235 and compare your Windows build and servicing stack version with the listed KB. Check that the November 2026 Patch Tuesday updates are installed (Settings > Windows Update > Update history).

## Timeline

- 2026-11-10T19:25:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88235
- 2026-11-10T20:43:19+00:00 analyst https://api.msrc.microsoft.com/cvrf/v3.0/updates/CVE-2026-88235 — MSRC lists the CVE in the November 2026 release (2026-11-10). The Security Update Guide page is JS-only, NVD returned nothing, and the browser tool is out of quota. So no affected builds, KB or mitigations were read. Nothing verified. Revisit when the MSRC page text or the CVRF entry can be read. Tier B; severity and exploited status left unchanged.

## Documents

- [advisory] MSRC CVRF update index for CVE-2026-88235 (November 2026 Security Updates) https://api.msrc.microsoft.com/cvrf/v3.0/updates/CVE-2026-88235

## From the sources

Unintended proxy or intermediary ('confused deputy') in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_