{"id":"CVE-2026-96043","kind":"vulnerability","aliases":["CVE-2026-96043"],"related":[],"title":"Windows Connection Manager: use-after-free lets a local user gain privileges","description":"Use after free in Windows Connection Manager Service allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in the Windows Connection Manager Service lets an attacker who already has a local, authorized account raise their privileges. The sources do not say whether the flaw is reachable remotely.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["connection-manager","infrastructure","local-privilege-escalation","use-after-free","windows"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":"Run winver (or PowerShell Get-HotFix) to get the Windows build and installed updates. Compare them with the CVE-2026-96043 entry in the Microsoft Security Update Guide (msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96043) and confirm the November 2026 cumulative update for that build is installed. Affected builds are not yet confirmed.","fix":"Install the November 2026 Windows security updates (Patch Tuesday, 2026-11-10). The KB number for each Windows build is not yet read from Microsoft's update guide.","status":"open","published_at":"2026-11-10T19:22:01+00:00","first_seen_at":"2026-11-10T19:25:28+00:00","triaged_at":"2026-11-10T19:49:29+00:00","updated_at":"2026-11-10T20:03:43+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:49:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Connection Manager: use-after-free lets a local user gain privileges","impact":"high","summary":"A use-after-free bug in the Windows Connection Manager Service lets an attacker who already has a local, authorized account raise their privileges. The sources do not say whether the flaw is reachable remotely.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","connection-manager"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-96043 to confirm affected Windows builds and the fixed update.","how_to_check":"- Check the Windows build with `winver` and compare it to Microsoft's security update guide entry for CVE-2026-96043\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Any Windows machine with the Connection Manager Service running and a local account that can log on is in scope, since the attacker must already be authorized on the machine. The sources do not name specific Windows builds or whether the service must be enabled. Shared workstations and servers with many local users are the most exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000696,"input_tokens":4484,"output_tokens":496,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-96043 to confirm affected Windows builds and the fixed update.","search":"'-2026':15A,18A '-96043':16A,19A 'account':54B 'allow':77C 'alreadi':49B 'attack':47B,80C 'author':53B,79C 'bug':38B 'connect':2A,21B,42B,74C 'connection-manag':20B 'cve':14A,17A 'elev':82C 'escal':27B 'flaw':65B 'free':7A,31B,37B,71C 'gain':12A 'infrastructur':23B 'let':8A,45B 'local':10A,25B,52B,84C 'local-privilege-escal':24B 'manag':3A,22B,43B,75C 'privileg':13A,26B,57B,83C 'rais':55B 'reachabl':67B 'remot':68B 'say':62B 'servic':44B,76C 'sourc':59B 'use':5A,29B,35B,69C 'use-after-fre':4A,28B,34B 'user':11A 'whether':63B 'window':1A,32B,41B,73C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine with the Connection Manager Service running and a local account that can log on is in scope, since the attacker must already be authorized on the machine. The sources do not name specific Windows builds or whether the service must be enabled. Shared workstations and servers with many local users are the most exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["connectionmanager","high","infrastructure","localprivilegeescalation","useafterfree","windows"],"campaign_type":null,"search_a":"'-2026':15A,18A '-96043':16A,19A 'connect':2A 'cve':14A,17A 'free':7A 'gain':12A 'let':8A 'local':10A 'manag':3A 'privileg':13A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A","search_b":"'account':54B 'alreadi':49B 'attack':47B 'author':53B 'bug':38B 'connect':21B,42B 'connection-manag':20B 'escal':27B 'flaw':65B 'free':31B,37B 'infrastructur':23B 'let':45B 'local':25B,52B 'local-privilege-escal':24B 'manag':22B,43B 'privileg':26B,57B 'rais':55B 'reachabl':67B 'remot':68B 'say':62B 'servic':44B 'sourc':59B 'use':29B,35B 'use-after-fre':28B,34B 'whether':63B 'window':32B,41B","search_c":"'allow':77C 'attack':80C 'author':79C 'connect':74C 'elev':82C 'free':71C 'local':84C 'manag':75C 'privileg':83C 'servic':76C 'use':69C 'window':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96043","severity":null,"published_at":"2026-11-10T19:22:01+00:00","modified_at":"2026-11-10T19:22:01+00:00","first_seen_at":"2026-11-10T19:25:28+00:00","fetched_at":"2026-11-10T19:25:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96043:2597","url":"https://api.msrc.microsoft.com/cvrf/v3.0/updates/CVE-2026-96043","severity":null,"published_at":"2026-11-10T20:03:43+00:00","modified_at":"2026-11-10T20:03:43+00:00","first_seen_at":"2026-11-10T20:03:43+00:00","fetched_at":"2026-11-10T20:03:43+00:00","note":"MSRC CVRF index confirms the CVE is in the November 2026 Security Updates (released 2026-11-10). The update guide page and CVRF document returned no text, so affected builds, KB numbers and the fixed versions are unknown. Nothing verified. No exploitation or PoC found in sources.","cites":["https://api.msrc.microsoft.com/cvrf/v3.0/updates/CVE-2026-96043"]}],"documents":[{"id":117747,"url":"https://api.msrc.microsoft.com/cvrf/v3.0/updates/CVE-2026-96043","title":"MSRC CVRF update index for CVE-2026-96043 (November 2026 Security Updates)","kind":"advisory","source":"analyst","publisher":null,"text":"MSRC CVRF index lists CVE-2026-96043 under the 2026-Nov release (November 2026 Security Updates), initial release 2026-11-10T08:00:00Z. No affected builds or KB numbers in this index.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}