---
id: "CVE-2026-94514"
page: "https://infrastack.ai/live/CVE-2026-94514"
kind: "vulnerability"
aliases: ["CVE-2026-94514"]
title: "Windows Kernel: race condition lets a local user gain higher privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kernel", "local", "privilege-escalation", "self-hosted", "windows"]
not_affected_if: ["unknown"]
published_at: "2026-11-10T19:21:37+00:00"
first_seen_at: "2026-11-10T19:25:21+00:00"
updated_at: "2026-11-10T20:38:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94514", "first_seen_at": "2026-11-10T19:25:21+00:00"}, {"source": "analyst", "url": "https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-17411.html/", "first_seen_at": "2026-11-10T20:38:11+00:00", "cites": ["https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-17411.html/"]}]
exploit_sources: []
---

# Windows Kernel: race condition lets a local user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-94514 (this .md is for agents)

Race condition (CWE-362) in the Windows kernel lets an authorized local attacker raise privileges. Per a Check Point copy of Microsoft's affected list, it covers Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2 and Server 2016/2019/2022/2025. Published in the November 2026 Patch Tuesday (10 Nov). Exploitation and PoC status not seen in any source read. Look at Windows machines where untrusted users or code can run (shared servers, RDS hosts, developer and CI machines); it is local only, so a single-user machine running no untrusted code is lower priority.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run winver (or PowerShell: Get-ComputerInfo | Select OsName,OsVersion,OsBuildNumber) and confirm the November 2026 cumulative update is installed (Get-HotFix). The fixed build and KB per Windows version are in the MSRC entry for CVE-2026-94514 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-94514); I could not read it, so they are not recorded here.

## Timeline

- 2026-11-10T19:25:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94514
- 2026-11-10T20:38:11+00:00 analyst https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-17411.html/ — MSRC page is JS-only and CVRF feed too large to fetch; NVD page returned no content. Affected list from Check Point copy only (not primary), so nothing verified; fix KB/builds unknown. X not checked (credits depleted per notes).

## Documents

- [describes] Check Point CPAI-2026-17411: Windows Kernel EoP (CVE-2026-94514) https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-17411.html/

## From the sources

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_