{"id":"CVE-2026-95976","kind":"vulnerability","aliases":["CVE-2026-95976"],"related":[],"title":"Windows Diagnostic Policy Service race condition lets a local user gain higher privileges","description":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.","summary":"A race condition in the Windows Diagnostic Policy Service lets an attacker who already has a local account raise their privileges. The sources do not describe the exploitation details beyond that.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Diagnostic Policy Service","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","windows","windows-server"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"Look up CVE-2026-95976 in the Microsoft Security Update Guide (msrc.microsoft.com/update-guide), find your Windows edition and build, and compare with 'winver' (or 'Get-ComputerInfo OsBuildNumber'). Affected builds and the fixing KB are not yet confirmed. DPS is on by default on Windows, so 'sc query DPS' showing RUNNING does not by itself show exposure.","fix":null,"status":"open","published_at":"2026-11-10T19:21:54+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","triaged_at":"2026-11-10T19:49:42+00:00","updated_at":"2026-11-10T20:15:44+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:49:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Diagnostic Policy Service race condition lets a local user gain higher privileges","impact":"high","summary":"A race condition in the Windows Diagnostic Policy Service lets an attacker who already has a local account raise their privileges. The sources do not describe the exploitation details beyond that.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-server"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains administrator or SYSTEM privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95976 for affected Windows builds and the patch.","how_to_check":"- Check the installed Windows build with `winver` and compare it against Microsoft's security update guide entry for CVE-2026-95976\n- Confirm the Diagnostic Policy Service (DPS) is running with `sc query DPS`","plain_action":"","product_name":"Windows Diagnostic Policy Service","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Only users who already have a local account on a Windows machine can use this flaw, since it is a local privilege escalation. Systems where untrusted people can log in locally are the most exposed. The sources do not list affected Windows versions.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000719,"input_tokens":4510,"output_tokens":535,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95976 for affected Windows builds and the patch.","search":"'-2026':15A,18A '-95976':16A,19A 'account':46B 'allow':74C 'alreadi':42B 'attack':40B,77C 'author':76C 'beyond':58B 'concurr':59C 'condit':6A,31B,68C 'cve':14A,17A 'describ':54B 'detail':57B 'diagnost':2A,35B,71C 'diagnostic':21A 'elev':79C 'execut':60C 'exploit':56B 'gain':11A 'higher':12A 'improp':65C 'infrastructur':24B 'let':7A,38B 'local':9A,45B,81C 'polici':3A,36B,72C 'policy':22A 'privileg':13A,49B,80C 'race':5A,30B,67C 'rais':47B 'resourc':63C 'server':28B 'servic':4A,37B,73C 'service':23A 'share':62C 'sourc':51B 'synchron':66C 'use':61C 'user':10A 'window':1A,25B,27B,34B,70C 'windows':20A 'windows-serv':26B","nicknames":[],"mitigations":[],"who_affected":"Only users who already have a local account on a Windows machine can use this flaw, since it is a local privilege escalation. Systems where untrusted people can log in locally are the most exposed. The sources do not list affected Windows versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["diagnosticpolicyservice","windowsdiagnosticpolicyservice"],"ptokens":["diagnostic","policy","service","windows"],"labels":["high","infrastructure","vendor","windows","windowsserver"],"campaign_type":null,"search_a":"'-2026':15A,18A '-95976':16A,19A 'condit':6A 'cve':14A,17A 'diagnost':2A 'diagnostic':21A 'gain':11A 'higher':12A 'let':7A 'local':9A 'polici':3A 'policy':22A 'privileg':13A 'race':5A 'servic':4A 'service':23A 'user':10A 'window':1A 'windows':20A","search_b":"'account':46B 'alreadi':42B 'attack':40B 'beyond':58B 'condit':31B 'describ':54B 'detail':57B 'diagnost':35B 'exploit':56B 'infrastructur':24B 'let':38B 'local':45B 'polici':36B 'privileg':49B 'race':30B 'rais':47B 'server':28B 'servic':37B 'sourc':51B 'window':25B,27B,34B 'windows-serv':26B","search_c":"'allow':74C 'attack':77C 'author':76C 'concurr':59C 'condit':68C 'diagnost':71C 'elev':79C 'execut':60C 'improp':65C 'local':81C 'polici':72C 'privileg':80C 'race':67C 'resourc':63C 'servic':73C 'share':62C 'synchron':66C 'use':61C 'window':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95976","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95976","severity":null,"published_at":"2026-11-10T19:21:54+00:00","modified_at":"2026-11-10T19:21:54+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","fetched_at":"2026-11-10T19:25:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95976:2630","url":null,"severity":null,"published_at":"2026-11-10T20:15:44+00:00","modified_at":"2026-11-10T20:15:44+00:00","first_seen_at":"2026-11-10T20:15:44+00:00","fetched_at":"2026-11-10T20:15:44+00:00","note":"MSRC advisory (3 URL forms) and NVD pages returned no content via web-cli; no primary source read, so no versions, fix or verification. Kept NVD description only (race condition in DPS, local EoP, CVSS 7.0 AV:L/AC:H/PR:L). Revisit when MSRC page is indexed."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}