Microsoft Windows PPPoE: Local privilege escalation via race condition

Summary

A race condition in the Windows Point-to-Point Protocol over Ethernet (PPPoE) component allows an authorized local user to elevate privileges. Exploitation requires an existing local foothold, such as a standard user account or malware already running on the system, and a high attack complexity. The attack cannot be launched remotely over the network. The CVE record lists several Windows 10, Windows 11 and Windows Server versions as affected. This entry is based on the CVE record; the MSRC page for this ID could not be verified during research.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019 (10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)

Fixed in

• Fixed builds according to the CVE record: 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974, 10.0.20348.5870
• Fix is part of the November 2026 security update. Unknown: specific KB number.

Workaround

Unknown.

Exploitation

• Exploitation in the wild: Unknown for this CVE ID.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• Public proof of concept: none found.

Our recommendation

• Verify the affected status and fixed builds on the MSRC advisory for CVE-2026-118123 before rollout.
• Install the November 2026 security update on all affected Windows systems, prioritising multi-user servers, terminal servers and shared workstations.
• Check whether the PPPoE component is in use; if not, it is still prudent to patch in the normal cycle.
• Limit local accounts and restrict untrusted code execution on servers to reduce the risk of a local foothold being escalated.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record CVE-2026-118123 (CVE Program) www.cve.org
• MSRC Security Update Guide, CVE-2026-118123 msrc.microsoft.com
• MSRC Security Update Guide, matching PPPoE entry CVE-2026-105511 msrc.microsoft.com
• Strix AI CVE overview, CVE-2026-118123 (unverified version list) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:54.