{"id":"CVE-2026-97000","kind":"vulnerability","aliases":["CVE-2026-97000"],"related":[],"title":"Windows USM Communication Manager: null pointer dereference lets local users gain higher privileges on Windows 10","description":"Null pointer dereference in Windows USM Communication Manager allows an authorized attacker to elevate privileges locally.","summary":"Null pointer dereference (CWE-476) in Windows USM Communication Manager lets an authorized local attacker elevate privileges. Microsoft rates it CVSS 7.0 (high complexity, low privileges required) with exploit code maturity 'unproven'. Microsoft's CVE record lists Windows 10 21H2 and 22H2 as affected.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 Version 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 Version 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows","windows-10"],"not_affected_if":["no-untrusted-local-users","windows-11"],"how_to_check":"Run winver or [System.Environment]::OSVersion in PowerShell. Windows 10 21H2 build below 10.0.19044.7846, or 22H2 build below 10.0.19045.7846, is affected. Windows 11 is not listed in the CVE record.","fix":"Install the November 2026 Windows 10 cumulative update that brings the build to 10.0.19044.7846 (21H2) or 10.0.19045.7846 (22H2) or later. KB number not read (MSRC page did not render).","status":"open","published_at":"2026-11-10T19:22:22+00:00","first_seen_at":"2026-11-10T19:25:34+00:00","triaged_at":"2026-11-10T19:48:00+00:00","updated_at":"2026-11-10T19:49:39+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:48:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows USM Communication Manager: null pointer lets local users gain privileges","impact":"high","summary":"A null pointer dereference in the Windows USM Communication Manager component lets an authorized local user raise their privileges. An attacker who already has a local account can gain higher rights on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds and the patch version.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Machines running Windows with the USM Communication Manager component; the sources do not name affected builds. The attacker must already be a local user, so systems without untrusted local accounts are lower risk. The sources do not say which Windows versions are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000655,"input_tokens":4491,"output_tokens":412,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds and the patch version.","search":"'-10':38B '-2026':18A,21A '-476':43B '-97000':19A,22A '10':16A,24A,28A,77B '21h2':26A,78B '22h2':30A,80B '7.0':60B 'affect':82B 'allow':91C 'attack':53B,94C 'author':51B,93C 'code':68B 'communic':3A,47B,89C 'complex':62B 'cve':17A,20A,73B 'cvss':59B 'cwe':42B 'derefer':7A,41B,85C 'elev':54B,96C 'escal':35B 'exploit':67B 'gain':11A 'high':61B 'higher':12A 'infrastructur':31B 'let':8A,49B 'list':75B 'local':9A,33B,52B,98C 'local-privilege-escal':32B 'low':63B 'manag':4A,48B,90C 'matur':69B 'microsoft':56B,71B 'null':5A,39B,83C 'pointer':6A,40B,84C 'privileg':13A,34B,55B,64B,97C 'rate':57B 'record':74B 'requir':65B 'unproven':70B 'user':10A 'usm':2A,46B,88C 'version':25A,29A 'window':1A,15A,36B,37B,45B,76B,87C 'windows':23A,27A","nicknames":[],"mitigations":[],"who_affected":"Windows 10 21H2 and 22H2 machines, including shared workstations, terminal servers and VDI where several people hold local accounts. The attacker needs a local account and the attack is rated high complexity. Single-user machines with no untrusted code, and Windows 11, can deprioritise it (Windows 11 is not listed in the record).","tier":"B","verified":{"products":{"at":"2026-11-10T19:49:39Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-97000","run_id":2557}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["10version21h2","10version22h2","windows10version21h2","windows10version22h2"],"ptokens":["10","21h2","22h2","version","windows"],"labels":["high","infrastructure","localprivilegeescalation","windows","windows10"],"campaign_type":null,"search_a":"'-2026':18A,21A '-97000':19A,22A '10':16A,24A,28A '21h2':26A '22h2':30A 'communic':3A 'cve':17A,20A 'derefer':7A 'gain':11A 'higher':12A 'let':8A 'local':9A 'manag':4A 'null':5A 'pointer':6A 'privileg':13A 'user':10A 'usm':2A 'version':25A,29A 'window':1A,15A 'windows':23A,27A","search_b":"'-10':38B '-476':43B '10':77B '21h2':78B '22h2':80B '7.0':60B 'affect':82B 'attack':53B 'author':51B 'code':68B 'communic':47B 'complex':62B 'cve':73B 'cvss':59B 'cwe':42B 'derefer':41B 'elev':54B 'escal':35B 'exploit':67B 'high':61B 'infrastructur':31B 'let':49B 'list':75B 'local':33B,52B 'local-privilege-escal':32B 'low':63B 'manag':48B 'matur':69B 'microsoft':56B,71B 'null':39B 'pointer':40B 'privileg':34B,55B,64B 'rate':57B 'record':74B 'requir':65B 'unproven':70B 'usm':46B 'window':36B,37B,45B,76B","search_c":"'allow':91C 'attack':94C 'author':93C 'communic':89C 'derefer':85C 'elev':96C 'local':98C 'manag':90C 'null':83C 'pointer':84C 'privileg':97C 'usm':88C 'window':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97000","severity":null,"published_at":"2026-11-10T19:22:22+00:00","modified_at":"2026-11-10T19:22:23+00:00","first_seen_at":"2026-11-10T19:25:34+00:00","fetched_at":"2026-11-10T19:25:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97000:2557","url":"https://cveawg.mitre.org/api/cve/CVE-2026-97000","severity":null,"published_at":"2026-11-10T19:49:39+00:00","modified_at":"2026-11-10T19:49:39+00:00","first_seen_at":"2026-11-10T19:49:39+00:00","fetched_at":"2026-11-10T19:49:39+00:00","note":"Read Microsoft's CNA CVE record and NVD (MSRC page is JS-only, did not render, so KB numbers unread). Affected: Windows 10 21H2 and 22H2 below 10.0.19044.7846 / 10.0.19045.7846. Local, CVSS 7.0, E:U (no exploitation per vendor vector). No PoC or posts searched.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-97000","https://nvd.nist.gov/vuln/detail/CVE-2026-97000"]}],"documents":[{"id":117694,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-97000","title":"CVE-2026-97000 CVE record (Microsoft CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":117695,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97000","title":"NVD CVE-2026-97000","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}