{"id":"CVE-2026-96042","kind":"vulnerability","aliases":["CVE-2026-96042"],"related":[],"title":"Windows Connection Manager: use-after-free lets a local user gain privileges","description":"Use after free in Windows Connection Manager Service allows an authorized attacker to elevate privileges locally.","summary":"Microsoft's CNA record describes a use-after-free in the Windows Connection Manager Service that lets an authorized local attacker elevate privileges (CVSS 7.0, local, high complexity, low privileges). No source read so far lists affected Windows builds or the fixing update, and no exploitation is reported.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Connection Manager Service","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local-accounts","windows"],"not_affected_if":["no-local-users"],"how_to_check":"Unknown until the MSRC entry for CVE-2026-96042 lists affected builds and KB numbers. Meanwhile, check that Windows Update is current on all machines where non-admin users can log in.","fix":null,"status":"open","published_at":"2026-11-10T19:22:01+00:00","first_seen_at":"2026-11-10T19:25:28+00:00","triaged_at":"2026-11-10T19:49:30+00:00","updated_at":"2026-11-10T20:03:25+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:49:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Connection Manager: use-after-free lets a local user gain privileges","impact":"high","summary":"A use-after-free bug in the Windows Connection Manager Service lets an attacker who already has a local account raise their privileges. The sources do not say which Windows versions are affected or how to fix it.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["windows","local-accounts"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Confirm affected Windows builds and the Microsoft security update that fixes CVE-2026-96042 from the MSRC advisory.","how_to_check":"- unknown","plain_action":"Install the latest Windows security update from Windows Update once Microsoft confirms the fix for this flaw.","product_name":"Windows Connection Manager Service","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Anyone with a local account on a Windows machine running the Connection Manager Service could be affected. The sources do not name specific Windows versions or editions. Machines where only trusted users log in carry less risk.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000691,"input_tokens":4484,"output_tokens":485,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Windows builds and the Microsoft security update that fixes CVE-2026-96042 from the MSRC advisory.","search":"'-2026':15A,18A '-96042':16A,19A '7.0':54B 'account':27B 'affect':66B 'allow':86C 'attack':50B,89C 'author':48B,88C 'build':68B 'cna':31B 'complex':57B 'connect':2A,42B,83C 'connection':21A 'cve':14A,17A 'cvss':53B 'describ':33B 'elev':51B,91C 'exploit':75B 'far':64B 'fix':71B 'free':7A,38B,80C 'gain':12A 'high':56B 'infrastructur':24B 'let':8A,46B 'list':65B 'local':10A,26B,49B,55B,93C 'local-account':25B 'low':58B 'manag':3A,43B,84C 'manager':22A 'microsoft':29B 'privileg':13A,52B,59B,92C 'read':62B 'record':32B 'report':77B 'servic':44B,85C 'service':23A 'sourc':61B 'updat':72B 'use':5A,36B,78C 'use-after-fre':4A,35B 'user':11A 'window':1A,28B,41B,67B,82C 'windows':20A","nicknames":[],"mitigations":[],"who_affected":"Anyone with a local account on a Windows machine running the Connection Manager Service could be affected. The sources do not name specific Windows versions or editions. Machines where only trusted users log in carry less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":["connectionmanagerservice","windowsconnectionmanagerservice"],"ptokens":["connection","manager","service","windows"],"labels":["high","infrastructure","localaccounts","vendor","windows"],"campaign_type":null,"search_a":"'-2026':15A,18A '-96042':16A,19A 'connect':2A 'connection':21A 'cve':14A,17A 'free':7A 'gain':12A 'let':8A 'local':10A 'manag':3A 'manager':22A 'privileg':13A 'service':23A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A 'windows':20A","search_b":"'7.0':54B 'account':27B 'affect':66B 'attack':50B 'author':48B 'build':68B 'cna':31B 'complex':57B 'connect':42B 'cvss':53B 'describ':33B 'elev':51B 'exploit':75B 'far':64B 'fix':71B 'free':38B 'high':56B 'infrastructur':24B 'let':46B 'list':65B 'local':26B,49B,55B 'local-account':25B 'low':58B 'manag':43B 'microsoft':29B 'privileg':52B,59B 'read':62B 'record':32B 'report':77B 'servic':44B 'sourc':61B 'updat':72B 'use':36B 'use-after-fre':35B 'window':28B,41B,67B","search_c":"'allow':86C 'attack':89C 'author':88C 'connect':83C 'elev':91C 'free':80C 'local':93C 'manag':84C 'privileg':92C 'servic':85C 'use':78C 'window':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96042","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96042","severity":null,"published_at":"2026-11-10T19:22:01+00:00","modified_at":"2026-11-10T19:22:01+00:00","first_seen_at":"2026-11-10T19:25:28+00:00","fetched_at":"2026-11-10T19:25:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96042:2598","url":null,"severity":null,"published_at":"2026-11-10T20:03:25+00:00","modified_at":"2026-11-10T20:03:25+00:00","first_seen_at":"2026-11-10T20:03:25+00:00","fetched_at":"2026-11-10T20:03:25+00:00","note":"MSRC page for this CVE not readable (JS-only/not indexed); NVD page has no content. Affected builds and KB fix unknown; nothing verified. Revisit when MSRC page is indexed. Sibling RasMan CVEs are different products."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}