{"id":"CVE-2026-96158","kind":"vulnerability","aliases":["CVE-2026-96158"],"related":[],"title":"Windows: ActiveX Installer Service flaw lets a local user gain higher privileges","description":"Use of uninitialized resource in Microsoft ActiveX Installer Service allows an authorized attacker to elevate privileges locally.","summary":"Microsoft's November 2026 Patch Tuesday fixes an elevation of privilege in the ActiveX Installer Service (CWE-908 uninitialized resource, with a race condition). A local attacker with a low-privilege account who wins the race can gain SYSTEM. Microsoft rates it Important (CVSS 7.0), not publicly disclosed, not exploited, 'Exploitation Less Likely'.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["activex-installer-service","infrastructure","local-privilege-escalation","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"Microsoft's machine-readable advisory gives no KB or build numbers. Open the CVE-2026-96158 page in the MSRC Security Update Guide (it needs JavaScript) to get the KB for your Windows version, then compare it with the installed updates: Get-HotFix -Id KBxxxxxxx in PowerShell, or Settings > Windows Update > Update history. Whether the update is installed is the check. Version and KB numbers are unknown here.","fix":null,"status":"open","published_at":"2026-11-10T19:22:13+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","triaged_at":"2026-11-10T19:48:07+00:00","updated_at":"2026-11-10T19:51:33+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:48:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: ActiveX Installer Service flaw lets a local user gain higher privileges","impact":"high","summary":"Microsoft's ActiveX Installer Service reads a resource that was never initialized, so an attacker with a local account can elevate privileges. The attacker must already be able to run code on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","activex-installer-service"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the affected Windows builds and the Microsoft advisory for CVE-2026-96158 to confirm the patch and the check.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines that have the ActiveX Installer Service present and where users hold local accounts. The sources do not give affected builds or whether the service is enabled by default. Systems with no untrusted local users are at lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":4500,"output_tokens":422,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and the Microsoft advisory for CVE-2026-96158 to confirm the patch and the check.","search":"'-2026':14A,17A '-908':46B '-96158':15A,18A '2026':32B '7.0':74B 'account':61B 'activex':2A,20B,42B,89C 'activex-installer-servic':19B 'allow':92C 'attack':55B,95C 'author':94C 'condit':52B 'cve':13A,16A 'cvss':73B 'cwe':45B 'disclos':77B 'elev':37B,97C 'escal':27B 'exploit':79B,80B 'fix':35B 'flaw':5A 'gain':10A,67B 'higher':11A 'import':72B 'infrastructur':23B 'instal':3A,21B,43B,90C 'less':81B 'let':6A 'like':82B 'local':8A,25B,54B,99C 'local-privilege-escal':24B 'low':59B 'low-privileg':58B 'microsoft':29B,69B,88C 'novemb':31B 'patch':33B 'privileg':12A,26B,39B,60B,98C 'public':76B 'race':51B,65B 'rate':70B 'resourc':48B,86C 'servic':4A,22B,44B,91C 'system':68B 'tuesday':34B 'uniniti':47B,85C 'use':83C 'user':9A 'win':63B 'window':1A,28B","nicknames":[],"mitigations":[],"who_affected":"Windows machines where a local user or malware can already run code, such as shared workstations, terminal servers and VDI hosts. Microsoft's advisory data does not list affected builds, so treat Windows systems as in scope until the November 2026 update table says otherwise. Single-user machines with no untrusted code have lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["activexinstallerservice","high","infrastructure","localprivilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-96158':15A,18A 'activex':2A 'cve':13A,16A 'flaw':5A 'gain':10A 'higher':11A 'instal':3A 'let':6A 'local':8A 'privileg':12A 'servic':4A 'user':9A 'window':1A","search_b":"'-908':46B '2026':32B '7.0':74B 'account':61B 'activex':20B,42B 'activex-installer-servic':19B 'attack':55B 'condit':52B 'cvss':73B 'cwe':45B 'disclos':77B 'elev':37B 'escal':27B 'exploit':79B,80B 'fix':35B 'gain':67B 'import':72B 'infrastructur':23B 'instal':21B,43B 'less':81B 'like':82B 'local':25B,54B 'local-privilege-escal':24B 'low':59B 'low-privileg':58B 'microsoft':29B,69B 'novemb':31B 'patch':33B 'privileg':26B,39B,60B 'public':76B 'race':51B,65B 'rate':70B 'resourc':48B 'servic':22B,44B 'system':68B 'tuesday':34B 'uniniti':47B 'win':63B 'window':28B","search_c":"'activex':89C 'allow':92C 'attack':95C 'author':94C 'elev':97C 'instal':90C 'local':99C 'microsoft':88C 'privileg':98C 'resourc':86C 'servic':91C 'uniniti':85C 'use':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96158","severity":null,"published_at":"2026-11-10T19:22:13+00:00","modified_at":"2026-11-10T19:22:13+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","fetched_at":"2026-11-10T19:25:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96158:2565","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-96158","severity":null,"published_at":"2026-11-10T19:51:33+00:00","modified_at":"2026-11-10T19:51:33+00:00","first_seen_at":"2026-11-10T19:51:33+00:00","fetched_at":"2026-11-10T19:51:33+00:00","note":"MSRC API read: Important, EoP to SYSTEM, AC:H race, not exploited, not disclosed, customer action required. Build/KB list not in API; the SUG page is JS-only. Fix versions unknown. Nothing verified. X and search not used.","cites":["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-96158"]}],"documents":[{"id":117704,"url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-96158","title":"MSRC: Microsoft ActiveX Installer Service Elevation of Privilege Vulnerability (CVE-2026-96158)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}