{"id":"CVE-2026-95988","kind":"vulnerability","aliases":["CVE-2026-95988"],"related":[],"title":"Windows 11 kernel: incorrect authorization lets a local user gain higher privileges","description":"Incorrect authorization in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"A flaw in the Windows kernel lets an attacker who already has a local account raise their privileges. Successful exploitation gives the attacker control beyond what their account should allow.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":">= 10.0.26100.0, < 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":">= 10.0.26200.0, < 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":">= 10.0.28000.0, < 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":">= 10.0.26300.0, < 10.0.26300.9974","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","multi-user-servers","shared-workstations","windows","windows-kernel"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":"Run winver (or [System.Environment]::OSVersion) and compare the build with the fixed build for your Windows 11 version: 24H2 fixed at 10.0.26100.9974, 25H2 at 10.0.26200.9974, 26H1 at 10.0.28000.3501, 26H2 at 10.0.26300.9974. Any lower build is affected. The KB number is unknown until the MSRC page is read.","fix":"Install the Windows update that brings the build to 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.28000.3501 (26H1) or 10.0.26300.9974 (26H2) or later. KB number unknown.","status":"open","published_at":"2026-11-10T19:21:55+00:00","first_seen_at":"2026-11-10T19:25:26+00:00","triaged_at":"2026-11-10T19:38:06+00:00","updated_at":"2026-11-10T20:14:31+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Kernel: authorization flaw lets a local user gain higher privileges","impact":"high","summary":"A flaw in the Windows kernel lets an attacker who already has a local account raise their privileges. Successful exploitation gives the attacker control beyond what their account should allow.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-kernel","shared-workstations","multi-user-servers"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains administrator or SYSTEM privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95988 to get the affected Windows builds and the fixed KB or build numbers.","how_to_check":"- Check the installed Windows build with `winver` and compare it against the fixed build in Microsoft's advisory for CVE-2026-95988\n- Confirm Windows Update has applied the latest cumulative updates: unknown for the exact patch KB, since the sources do not name it","plain_action":"Install the latest Windows security update through Windows Update, since the sources do not name a specific fixed version.","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Windows machines where an attacker already has a local user account, including shared workstations and multi-user servers. The sources do not say which Windows versions are affected, so unknown for the exact range. Machines where only trusted administrators log on are lower risk but still need the patch.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4484,"output_tokens":579,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95988 to get the affected Windows builds and the fixed KB or build numbers.","search":"'-2026':14A,17A '-95988':15A,18A '11':2A,20A,23A,26A,29A '24h2':21A '25h2':24A '26h1':27A '26h2':30A 'account':61B,74B 'allow':76B,82C 'alreadi':57B 'attack':55B,69B,85C 'author':5A,78C,84C 'beyond':71B 'control':70B 'cve':13A,16A 'elev':87C 'escal':35B 'exploit':66B 'flaw':48B 'gain':10A 'give':67B 'higher':11A 'incorrect':4A,77C 'infrastructur':31B 'kernel':3A,46B,52B,81C 'let':6A,53B 'local':8A,33B,60B,89C 'local-privilege-escal':32B 'multi':37B 'multi-user-serv':36B 'privileg':12A,34B,64B,88C 'rais':62B 'server':39B 'share':41B 'shared-workst':40B 'success':65B 'user':9A,38B 'window':1A,43B,45B,51B,80C 'windows':19A,22A,25A,28A 'windows-kernel':44B 'workstat':42B","nicknames":[],"mitigations":[],"who_affected":"Windows 11 24H2, 25H2, 26H1 and 26H2 machines (builds below those listed by Microsoft in the CVE record) where someone already has a local low-privilege account, such as shared workstations, multi-user servers or remote desktop hosts. Machines used by one trusted user with no untrusted code running can treat it as lower priority. Other Windows versions are not listed in the record read.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["1124h2","1125h2","1126h1","1126h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2"],"ptokens":["11","24h2","25h2","26h1","26h2","windows"],"labels":["high","infrastructure","localprivilegeescalation","multiuserservers","sharedworkstations","windows","windowskernel"],"campaign_type":null,"search_a":"'-2026':14A,17A '-95988':15A,18A '11':2A,20A,23A,26A,29A '24h2':21A '25h2':24A '26h1':27A '26h2':30A 'author':5A 'cve':13A,16A 'gain':10A 'higher':11A 'incorrect':4A 'kernel':3A 'let':6A 'local':8A 'privileg':12A 'user':9A 'window':1A 'windows':19A,22A,25A,28A","search_b":"'account':61B,74B 'allow':76B 'alreadi':57B 'attack':55B,69B 'beyond':71B 'control':70B 'escal':35B 'exploit':66B 'flaw':48B 'give':67B 'infrastructur':31B 'kernel':46B,52B 'let':53B 'local':33B,60B 'local-privilege-escal':32B 'multi':37B 'multi-user-serv':36B 'privileg':34B,64B 'rais':62B 'server':39B 'share':41B 'shared-workst':40B 'success':65B 'user':38B 'window':43B,45B,51B 'windows-kernel':44B 'workstat':42B","search_c":"'allow':82C 'attack':85C 'author':78C,84C 'elev':87C 'incorrect':77C 'kernel':81C 'local':89C 'privileg':88C 'window':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95988","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95988","severity":null,"published_at":"2026-11-10T19:21:55+00:00","modified_at":"2026-11-10T19:21:55+00:00","first_seen_at":"2026-11-10T19:25:26+00:00","fetched_at":"2026-11-10T19:25:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95988:2626","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95988","severity":null,"published_at":"2026-11-10T20:14:31+00:00","modified_at":"2026-11-10T20:14:31+00:00","first_seen_at":"2026-11-10T20:14:31+00:00","fetched_at":"2026-11-10T20:14:31+00:00","note":"NVD page (Microsoft CNA data) gives affected Windows 11 builds and fixed builds; MSRC page is JS-only and not read, KB numbers unknown, nothing verified. No exploitation or PoC seen.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-95988"]}],"documents":[{"id":117808,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95988","title":"NVD CVE-2026-95988 (Microsoft CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}