{"id":"CVE-2026-96845","kind":"vulnerability","aliases":["CVE-2026-96845"],"related":[],"title":"Windows Task Scheduler: local user can gain elevated privileges","description":"Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.","summary":"Windows Task Scheduler has an improper authorization flaw that lets an already-authorized local user elevate their privileges. An attacker with a local account could gain higher system rights on the affected machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10/11 and Windows Server","fixed":["10.0.14393.9612","10.0.17763.9376","10.0.19044.7807","10.0.19045.7807","10.0.22631.7652","10.0.26100.9711","10.0.26100.33650","10.0.26200.9711","10.0.28000.3231","10.0.26300.9711","10.0.20348.5761","6.2.9200.26434","6.3.9600.23470"],"affected":"below fixed build per version (see fix)","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","task-scheduler","windows"],"not_affected_if":["no-local-users"],"how_to_check":"Run winver or [System.Environment]::OSVersion / (Get-ComputerInfo).OsBuildNumber and compare the full build (e.g. 10.0.26100.x) to the fixed builds listed in the product rows; an installed build below the fixed one is exposed. Confirm the KB in Microsoft's Security Update Guide.","fix":"Install the November 2026 Windows cumulative update that raises the build to at least: Win10 1607/Server 2016 10.0.14393.9612; 1809/Server 2019 10.0.17763.9376; 21H2 10.0.19044.7807; 22H2 10.0.19045.7807; Win11 23H2 10.0.22631.7652; 24H2/Server 2025 builds 10.0.26100.9711 (Win11) / 10.0.26100.33650 (Server 2025); 25H2 10.0.26200.9711; 26H1 10.0.28000.3231; 26H2 10.0.26300.9711; Server 2022 10.0.20348.5761; Server 2012 6.2.9200.26434; 2012 R2 6.3.9600.23470.","status":"open","published_at":"2026-11-10T19:22:18+00:00","first_seen_at":"2026-11-10T19:25:33+00:00","triaged_at":"2026-11-10T19:36:17+00:00","updated_at":"2026-11-10T19:37:57+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:36:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Task Scheduler: local user can gain elevated privileges","impact":"high","summary":"Windows Task Scheduler has an improper authorization flaw that lets an already-authorized local user elevate their privileges. An attacker with a local account could gain higher system rights on the affected machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","task-scheduler"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains higher system privileges on the machine","analyst_note":"Check Microsoft's security update guide entry for CVE-2026-96845 for affected Windows versions and the patch that fixes it.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Affects Windows machines where a local user with some access can run code or interact with Task Scheduler; the sources do not list affected Windows builds or configurations. Machines with no untrusted local users are at lower practical risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000658,"input_tokens":4486,"output_tokens":418,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Microsoft's security update guide entry for CVE-2026-96845 for affected Windows versions and the patch that fixes it.","search":"'-2026':11A,14A '-96845':12A,15A '10/11':17A 'account':54B 'affect':62B 'allow':70C 'alreadi':42B 'already-author':41B 'and':18A 'attack':50B,73C 'author':36B,43B,65C,72C 'could':55B 'cve':10A,13A 'elev':8A,46B,75C 'escal':25B 'flaw':37B 'gain':7A,56B 'higher':57B 'improp':35B,64C 'infrastructur':21B 'let':39B 'local':4A,23B,44B,53B,77C 'local-privilege-escal':22B 'machin':63B 'privileg':9A,24B,48B,76C 'right':59B 'schedul':3A,28B,32B,69C 'server':20A 'system':58B 'task':2A,27B,31B,68C 'task-schedul':26B 'user':5A,45B 'window':1A,29B,30B,67C 'windows':16A,19A","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10, Windows 11 or Windows Server (2012 to 2025) machine below the fixed build is listed as affected by Microsoft's CNA data. An attacker needs a local low-privilege account, so shared servers, RDS/terminal hosts, developer and CI Windows machines matter most. Single-user machines with no untrusted local code are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["1011andwindowsserver","windows1011andwindowsserver"],"ptokens":["10","11","and","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","taskscheduler","windows"],"campaign_type":null,"search_a":"'-2026':11A,14A '-96845':12A,15A '10/11':17A 'and':18A 'cve':10A,13A 'elev':8A 'gain':7A 'local':4A 'privileg':9A 'schedul':3A 'server':20A 'task':2A 'user':5A 'window':1A 'windows':16A,19A","search_b":"'account':54B 'affect':62B 'alreadi':42B 'already-author':41B 'attack':50B 'author':36B,43B 'could':55B 'elev':46B 'escal':25B 'flaw':37B 'gain':56B 'higher':57B 'improp':35B 'infrastructur':21B 'let':39B 'local':23B,44B,53B 'local-privilege-escal':22B 'machin':63B 'privileg':24B,48B 'right':59B 'schedul':28B,32B 'system':58B 'task':27B,31B 'task-schedul':26B 'user':45B 'window':29B,30B","search_c":"'allow':70C 'attack':73C 'author':65C,72C 'elev':75C 'improp':64C 'local':77C 'privileg':76C 'schedul':69C 'task':68C 'window':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96845","severity":null,"published_at":"2026-11-10T19:22:18+00:00","modified_at":"2026-11-10T19:22:18+00:00","first_seen_at":"2026-11-10T19:25:33+00:00","fetched_at":"2026-11-10T19:25:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96845:2532","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96845","severity":null,"published_at":"2026-11-10T19:37:57+00:00","modified_at":"2026-11-10T19:37:57+00:00","first_seen_at":"2026-11-10T19:37:57+00:00","fetched_at":"2026-11-10T19:37:57+00:00","note":"MSRC page is JS-only (loaded empty); affected builds/fixed builds taken from Microsoft CNA data on NVD. KB numbers not read, nothing marked verified. No exploitation or PoC seen; not searched socially.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-96845"]}],"documents":[{"id":117600,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96845","title":"NVD CVE-2026-96845 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}