---
id: "CVE-2026-96042"
page: "https://infrastack.ai/live/CVE-2026-96042"
kind: "vulnerability"
aliases: ["CVE-2026-96042"]
title: "Windows Connection Manager: use-after-free lets a local user gain privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Connection Manager Service", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "local-accounts", "windows"]
not_affected_if: ["no-local-users"]
published_at: "2026-11-10T19:22:01+00:00"
first_seen_at: "2026-11-10T19:25:28+00:00"
updated_at: "2026-11-10T20:03:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96042", "first_seen_at": "2026-11-10T19:25:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T20:03:25+00:00"}]
exploit_sources: []
---

# Windows Connection Manager: use-after-free lets a local user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-96042 (this .md is for agents)

Microsoft's CNA record describes a use-after-free in the Windows Connection Manager Service that lets an authorized local attacker elevate privileges (CVSS 7.0, local, high complexity, low privileges). No source read so far lists affected Windows builds or the fixing update, and no exploitation is reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Connection Manager Service affected range not listed fixed no fixed version listed

## How to check

Unknown until the MSRC entry for CVE-2026-96042 lists affected builds and KB numbers. Meanwhile, check that Windows Update is current on all machines where non-admin users can log in.

## Timeline

- 2026-11-10T19:25:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96042
- 2026-11-10T20:03:25+00:00 analyst — MSRC page for this CVE not readable (JS-only/not indexed); NVD page has no content. Affected builds and KB fix unknown; nothing verified. Revisit when MSRC page is indexed. Sibling RasMan CVEs are different products.

## From the sources

Use after free in Windows Connection Manager Service allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_