{"id":"CVE-2026-96075","kind":"vulnerability","aliases":["CVE-2026-96075"],"related":[],"title":"Windows Feedback Hub race condition lets a local user gain higher privileges","description":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Feedback Hub allows an authorized attacker to elevate privileges locally.","summary":"Windows Feedback Hub has a race condition in how it handles a shared resource, so it can be made to run work in an unsafe order. An attacker who already has a local account can use this to elevate their privileges.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["feedback-hub","infrastructure","local","privilege-escalation","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"Run winver or [System.Environment]::OSVersion.Version in PowerShell and compare the full build (e.g. 10.0.22631.xxxx) to the fixed builds in the fix field; lower means exposed. Also check Get-AppxPackage Microsoft.WindowsFeedbackHub to see if the app is installed (installation requirement not stated by Microsoft; unconfirmed).","fix":"Install the November 2026 Windows cumulative update that brings your build to at least: Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H2 10.0.26300.9974; Win11 26H1 10.0.28000.3501; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. KB numbers not read (MSRC page needs JavaScript).","status":"open","published_at":"2026-11-10T19:22:05+00:00","first_seen_at":"2026-11-10T19:25:29+00:00","triaged_at":"2026-11-10T19:49:24+00:00","updated_at":"2026-11-10T19:55:19+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-10T19:49:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Feedback Hub: race condition lets a local user gain higher privileges","impact":"high","summary":"Windows Feedback Hub has a race condition in how it handles a shared resource, so it can be made to run work in an unsafe order. An attacker who already has a local account can use this to elevate their privileges.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["windows","feedback-hub"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-96075 for affected Windows builds, the fixed update and any mitigation.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Anyone running Windows with the Feedback Hub app installed. The attacker must already be a local user on the machine, so exposure is limited to shared or multi-user computers. The sources do not give affected builds or whether the app must be running.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000671,"input_tokens":4507,"output_tokens":441,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-96075 for affected Windows builds, the fixed update and any mitigation.","search":"'-2026':14A,17A '-96075':15A,18A '10':20A,23A '11':26A,29A,32A,35A,38A '2022':42A '2025':45A '21h2':21A '22h2':24A '23h2':27A '24h2':30A '25h2':33A '26h1':39A '26h2':36A 'account':88B 'allow':110C 'alreadi':84B 'attack':82B,113C 'author':112C 'concurr':96C 'condit':5A,61B,105C 'cve':13A,16A 'elev':93B,115C 'escal':53B 'execut':97C 'feedback':2A,47B,56B,108C 'feedback-hub':46B 'gain':10A 'handl':65B 'higher':11A 'hub':3A,48B,57B,109C 'improp':102C 'infrastructur':49B 'let':6A 'local':8A,50B,87B,117C 'made':73B 'order':80B 'privileg':12A,52B,95B,116C 'privilege-escal':51B 'race':4A,60B,104C 'resourc':68B,100C 'run':75B 'server':41A,44A 'share':67B,99C 'synchron':103C 'unsaf':79B 'use':90B,98C 'user':9A 'window':1A,54B,55B,107C 'windows':19A,22A,25A,28A,31A,34A,37A,40A,43A 'work':76B","nicknames":[],"mitigations":[],"who_affected":"Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2022/2025 (including Server Core) with builds below the fixed ones. The attacker needs a local low-privilege account and the attack is rated high complexity, so shared, multi-user or terminal-server machines matter most. Single-user machines with no untrusted local users can wait for the normal patch cycle.","tier":"B","verified":{"fix":{"at":"2026-11-10T19:55:19Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-96075","run_id":2577},"products":{"at":"2026-11-10T19:55:19Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-96075","run_id":2577}},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Install the latest Windows updates: Settings > Windows Update > Check for updates.","pkeys":["1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["feedbackhub","high","infrastructure","local","privilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-96075':15A,18A '10':20A,23A '11':26A,29A,32A,35A,38A '2022':42A '2025':45A '21h2':21A '22h2':24A '23h2':27A '24h2':30A '25h2':33A '26h1':39A '26h2':36A 'condit':5A 'cve':13A,16A 'feedback':2A 'gain':10A 'higher':11A 'hub':3A 'let':6A 'local':8A 'privileg':12A 'race':4A 'server':41A,44A 'user':9A 'window':1A 'windows':19A,22A,25A,28A,31A,34A,37A,40A,43A","search_b":"'account':88B 'alreadi':84B 'attack':82B 'condit':61B 'elev':93B 'escal':53B 'feedback':47B,56B 'feedback-hub':46B 'handl':65B 'hub':48B,57B 'infrastructur':49B 'local':50B,87B 'made':73B 'order':80B 'privileg':52B,95B 'privilege-escal':51B 'race':60B 'resourc':68B 'run':75B 'share':67B 'unsaf':79B 'use':90B 'window':54B,55B 'work':76B","search_c":"'allow':110C 'attack':113C 'author':112C 'concurr':96C 'condit':105C 'elev':115C 'execut':97C 'feedback':108C 'hub':109C 'improp':102C 'local':117C 'privileg':116C 'race':104C 'resourc':100C 'share':99C 'synchron':103C 'use':98C 'window':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96075","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96075","severity":null,"published_at":"2026-11-10T19:22:05+00:00","modified_at":"2026-11-10T19:22:05+00:00","first_seen_at":"2026-11-10T19:25:29+00:00","fetched_at":"2026-11-10T19:25:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96075:2577","url":"https://cveawg.mitre.org/api/cve/CVE-2026-96075","severity":null,"published_at":"2026-11-10T19:55:19+00:00","modified_at":"2026-11-10T19:55:19+00:00","first_seen_at":"2026-11-10T19:55:19+00:00","fetched_at":"2026-11-10T19:55:19+00:00","note":"Read Microsoft's CNA CVE record (MSRC page is JS-only, unreadable): affected builds and fixed builds listed; CVSS 7.0 AV:L/AC:H/PR:L; E:U (no exploit reported). KB numbers, mitigations and exploitability text not read. No posts searched.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-96075"]}],"documents":[{"id":117711,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-96075","title":"CVE-2026-96075 CVE record published by Microsoft (CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}