{"id":"CVE-2026-95987","kind":"vulnerability","aliases":["CVE-2026-95987"],"related":[],"title":"Windows User Manager Service: use-after-free lets a local user gain privileges","description":"Use after free in Windows User Manager Service allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free in the Windows User Manager Service lets a user with a local low-privilege account gain higher privileges (CVSS 7.0, local, high complexity). Microsoft's CNA data on NVD lists fixed build numbers per Windows version. The KB numbers and whether it is exploited are not confirmed; the MSRC page could not be read.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"},{"name":"Windows Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","local","privilege-escalation","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"Run 'winver' or PowerShell '[System.Environment]::OSVersion.Version' and compare the build (e.g. 10.0.26100.x) against the fixed builds. Below the fixed build means exposed. Look up the KB for your build in the MSRC entry for CVE-2026-95987.","fix":"Install the November 2026 Windows cumulative update. Fixed builds per NVD/Microsoft: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. KB numbers unconfirmed.","status":"open","published_at":"2026-11-10T19:21:55+00:00","first_seen_at":"2026-11-10T19:25:26+00:00","triaged_at":"2026-11-10T19:49:39+00:00","updated_at":"2026-11-10T20:14:30+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:49:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows User Manager Service: use-after-free lets a local user gain privileges","impact":"high","summary":"A use-after-free bug in the Windows User Manager Service lets an attacker who already has a local account raise their privileges. The sources do not say which Windows builds are affected or what fix Microsoft shipped.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find Microsoft's MSRC entry for CVE-2026-95987 to list affected Windows builds, the patch KB, and whether exploitation is seen.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Machines running the Windows User Manager Service where an untrusted or low-privilege user has a local login. The sources do not list affected Windows versions, so treat every supported Windows host as in scope until the vendor advisory is checked.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000668,"input_tokens":4480,"output_tokens":440,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Microsoft's MSRC entry for CVE-2026-95987 to list affected Windows builds, the patch KB, and whether exploitation is seen.","search":"'-2026':16A,19A '-95987':17A,20A '10':31A '11':22A,25A,28A '2016':44A '2019':41A '2022':35A '2025':38A '22h2':32A '23h2':29A '24h2':23A '25h2':26A '7.0':76B 'account':71B 'allow':119C 'attack':122C 'author':121C 'build':88B 'cna':82B 'complex':79B 'confirm':103B 'could':107B 'cve':15A,18A 'cvss':75B 'data':83B 'elev':124C 'escal':49B 'exploit':100B 'fix':87B 'free':8A,55B,113C 'gain':13A,72B 'high':78B 'higher':73B 'infrastructur':45B 'kb':94B 'let':9A,62B 'list':86B 'local':11A,46B,67B,77B,126C 'low':69B 'low-privileg':68B 'manag':3A,60B,117C 'microsoft':80B 'msrc':105B 'number':89B,95B 'nvd':85B 'page':106B 'per':90B 'privileg':14A,48B,70B,74B,125C 'privilege-escal':47B 'read':110B 'server':34A,37A,40A,43A 'servic':4A,61B,118C 'use':6A,53B,111C 'use-after-fre':5A,52B 'user':2A,12A,59B,64B,116C 'version':92B 'whether':97B 'window':1A,50B,58B,91B,115C 'windows':21A,24A,27A,30A,33A,36A,39A,42A","nicknames":[],"mitigations":[],"who_affected":"Windows 10, Windows 11 and Windows Server 2016 to 2025 hosts below the fixed builds where someone who is not an admin can log in locally or run code (shared servers, RDS/terminal servers, developer and CI machines). Single-user machines with no untrusted local code carry less risk. It needs a local account first and is not remotely reachable by itself.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["1022h2","1123h2","1124h2","1125h2","server2016","server2019","server2022","server2025","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windowsserver2016","windowsserver2019","windowsserver2022","windowsserver2025"],"ptokens":["10","11","2016","2019","2022","2025","22h2","23h2","24h2","25h2","server","windows"],"labels":["high","infrastructure","local","privilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':16A,19A '-95987':17A,20A '10':31A '11':22A,25A,28A '2016':44A '2019':41A '2022':35A '2025':38A '22h2':32A '23h2':29A '24h2':23A '25h2':26A 'cve':15A,18A 'free':8A 'gain':13A 'let':9A 'local':11A 'manag':3A 'privileg':14A 'server':34A,37A,40A,43A 'servic':4A 'use':6A 'use-after-fre':5A 'user':2A,12A 'window':1A 'windows':21A,24A,27A,30A,33A,36A,39A,42A","search_b":"'7.0':76B 'account':71B 'build':88B 'cna':82B 'complex':79B 'confirm':103B 'could':107B 'cvss':75B 'data':83B 'escal':49B 'exploit':100B 'fix':87B 'free':55B 'gain':72B 'high':78B 'higher':73B 'infrastructur':45B 'kb':94B 'let':62B 'list':86B 'local':46B,67B,77B 'low':69B 'low-privileg':68B 'manag':60B 'microsoft':80B 'msrc':105B 'number':89B,95B 'nvd':85B 'page':106B 'per':90B 'privileg':48B,70B,74B 'privilege-escal':47B 'read':110B 'servic':61B 'use':53B 'use-after-fre':52B 'user':59B,64B 'version':92B 'whether':97B 'window':50B,58B,91B","search_c":"'allow':119C 'attack':122C 'author':121C 'elev':124C 'free':113C 'local':126C 'manag':117C 'privileg':125C 'servic':118C 'use':111C 'user':116C 'window':115C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95987","severity":null,"published_at":"2026-11-10T19:21:55+00:00","modified_at":"2026-11-10T19:21:55+00:00","first_seen_at":"2026-11-10T19:25:26+00:00","fetched_at":"2026-11-10T19:25:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95987:2627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95987","severity":null,"published_at":"2026-11-10T20:14:30+00:00","modified_at":"2026-11-10T20:14:30+00:00","first_seen_at":"2026-11-10T20:14:30+00:00","fetched_at":"2026-11-10T20:14:30+00:00","note":"MSRC page is JS-only and unreadable here; affected builds taken from Microsoft CNA data on NVD. KB numbers and exploitation status not seen; nothing marked verified.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-95987"]}],"documents":[{"id":117807,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95987","title":"NVD CVE-2026-95987 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}