{"id":"CVE-2026-97013","kind":"vulnerability","aliases":["CVE-2026-97013"],"related":[],"title":"Windows Shell: type confusion lets a local user gain higher privileges","description":"Access of resource using incompatible type ('type confusion') in Windows Shell allows an authorized attacker to elevate privileges locally.","summary":"A type confusion flaw in Windows Shell lets a user who already has a local account gain SYSTEM privileges. Microsoft rates it Important (CVSS 7.8), not exploited and not publicly disclosed at release on 10 Nov 2026, but marks it 'Exploitation More Likely'.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Shell","fixed":[],"affected":"Windows 10 1607, 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 26H1, 26H2; Windows Server 2016, 2019, 2022, 2025 (per Check Point; build numbers unknown)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local","privilege-escalation","windows","windows-shell"],"not_affected_if":["no-local-accounts","non-windows"],"how_to_check":"Run winver (or PowerShell: Get-ComputerInfo OsBuildNumber) and confirm the November 2026 cumulative update is installed (Get-HotFix, or Settings > Windows Update > Update history). Find the fixed build for your Windows version in the MSRC Update Guide entry for CVE-2026-97013; the API we read did not list KB numbers.","fix":"Install the November 2026 (2026-Nov) Windows security update for your Windows version. Specific KB and build numbers: unknown, take them from the MSRC Update Guide.","status":"open","published_at":"2026-11-10T19:22:23+00:00","first_seen_at":"2026-11-10T19:25:34+00:00","triaged_at":"2026-11-10T19:36:18+00:00","updated_at":"2026-11-10T19:37:40+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-11-10T19:36:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Shell: type confusion lets a local user gain higher privileges","impact":"high","summary":"A type confusion flaw in the Windows Shell lets an attacker who already has a local account use a resource in the wrong way. The attacker can elevate privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-shell"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains administrator or SYSTEM privileges on the machine","analyst_note":"Find Microsoft's advisory for CVE-2026-97013 to confirm affected Windows builds and the patch.","how_to_check":"- Check the Windows build with `winver` and compare it against the fixed build listed in Microsoft's advisory for CVE-2026-97013.\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"Windows Shell","needs_analyst":true,"not_affected_if":["no-local-accounts","non-windows"],"who_is_affected":"Windows machines where a user already has a local account can be affected, since the attacker must be authorized on the system first. Servers and workstations both fall under this flaw as described. The sources do not say which Windows versions are affected, so treat all supported Windows builds as in scope until Microsoft's advisory is checked.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000717,"input_tokens":4495,"output_tokens":534,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Microsoft's advisory for CVE-2026-97013 to confirm affected Windows builds and the patch.","search":"'-2026':13A,16A '-97013':14A,17A '10':63B '2026':65B '7.8':53B 'access':72C 'account':44B 'allow':83C 'alreadi':40B 'attack':86C 'author':85C 'confus':4A,31B,79C 'cve':12A,15A 'cvss':52B 'disclos':59B 'elev':88C 'escal':24B 'exploit':55B,69B 'flaw':32B 'gain':9A,45B 'higher':10A 'import':51B 'incompat':76C 'infrastructur':20B 'let':5A,36B 'like':71B 'local':7A,21B,43B,90C 'mark':67B 'microsoft':48B 'nov':64B 'privileg':11A,23B,47B,89C 'privilege-escal':22B 'public':58B 'rate':49B 'releas':61B 'resourc':74C 'shell':2A,19A,28B,35B,82C 'system':46B 'type':3A,30B,77C,78C 'use':75C 'user':8A,38B 'window':1A,25B,27B,34B,81C 'windows':18A 'windows-shel':26B","nicknames":[],"mitigations":[],"who_affected":"Windows machines where a user already has a local account can be affected, since the attacker must be authorized on the system first. Servers and workstations both fall under this flaw as described. The sources do not say which Windows versions are affected, so treat all supported Windows builds as in scope until Microsoft's advisory is checked.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["shell","windowsshell"],"ptokens":["shell","windows"],"labels":["high","infrastructure","local","privilegeescalation","vendor","windows","windowsshell"],"campaign_type":null,"search_a":"'-2026':13A,16A '-97013':14A,17A 'confus':4A 'cve':12A,15A 'gain':9A 'higher':10A 'let':5A 'local':7A 'privileg':11A 'shell':2A,19A 'type':3A 'user':8A 'window':1A 'windows':18A","search_b":"'10':63B '2026':65B '7.8':53B 'account':44B 'alreadi':40B 'confus':31B 'cvss':52B 'disclos':59B 'escal':24B 'exploit':55B,69B 'flaw':32B 'gain':45B 'import':51B 'infrastructur':20B 'let':36B 'like':71B 'local':21B,43B 'mark':67B 'microsoft':48B 'nov':64B 'privileg':23B,47B 'privilege-escal':22B 'public':58B 'rate':49B 'releas':61B 'shell':28B,35B 'system':46B 'type':30B 'user':38B 'window':25B,27B,34B 'windows-shel':26B","search_c":"'access':72C 'allow':83C 'attack':86C 'author':85C 'confus':79C 'elev':88C 'incompat':76C 'local':90C 'privileg':89C 'resourc':74C 'shell':82C 'type':77C,78C 'use':75C 'window':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97013","severity":null,"published_at":"2026-11-10T19:22:23+00:00","modified_at":"2026-11-10T19:22:23+00:00","first_seen_at":"2026-11-10T19:25:34+00:00","fetched_at":"2026-11-10T19:25:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97013:2531","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-97013","severity":null,"published_at":"2026-11-10T19:37:40+00:00","modified_at":"2026-11-10T19:37:40+00:00","first_seen_at":"2026-11-10T19:37:40+00:00","fetched_at":"2026-11-10T19:37:40+00:00","note":"MSRC record (Nov 2026 release): Important, EoP to SYSTEM, not exploited, not publicly disclosed, 'Exploitation More Likely'. MSRC API gave no KB/build numbers; affected list from Check Point only (secondary), so not verified. Fix = install Nov 2026 cumulative update; exact KB unknown.","cites":["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-97013","https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-17596.html/"]}],"documents":[{"id":117598,"url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-97013","title":"MSRC: Windows Shell Elevation of Privilege Vulnerability CVE-2026-97013","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":117599,"url":"https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-17596.html/","title":"Check Point CPAI-2026-17596 (CVE-2026-97013)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}