Windows Network Connection Broker: Local privilege escalation

Summary

Improper authorization in the Windows Network Connection Broker component allows an attacker with a local, low-privilege account to elevate privileges on the affected system. The CVSS 3.1 base score is 7.8 (HIGH), with high impact on confidentiality, integrity and availability. The vulnerability is not remotely exploitable by itself. The CNA record classifies the weakness as CWE-290, which does not match the improper authorization description, so the classification may change.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): before 10.0.17763.9487
• Windows 10 Version 21H2: before 10.0.19044.7846
• Windows 10 Version 22H2: before 10.0.19045.7846
• Windows 11 Version 23H2: before 10.0.22631.7711
• Windows 11 Version 24H2: before 10.0.26100.9974
• Windows 11 Version 25H2: before 10.0.26200.9974
• Windows 11 Version 26H1: before 10.0.28000.3501
• Windows 11 Version 26H2: before 10.0.26300.9974
• Windows Server 2022: before 10.0.20348.5870

Fixed in

• November 2026 security updates for each affected Windows build, as listed in the MSRC Security Update Guide. Install the build in the affected version list or later.

Workaround

Unknown. No workaround is documented in the sources. Patching is the only documented remediation.

Exploitation

• No known exploitation at the time of publication (CISA SSVC: exploitation none; Microsoft temporal metric E:U).
• No public proof of concept found.
• Not confirmed in CISA KEV at the time of writing.

Our recommendation

• Install the November 2026 cumulative update on all affected Windows systems, starting with terminal servers and shared workstations.
• Identify and retire Windows 10 1607 and 1809 systems that no longer receive security updates.
• Limit local accounts and review who can log on locally to servers and shared systems.
• Monitor for unexpected privilege changes and new local administrator accounts.
• Verify the affected versions and KB numbers on the MSRC Security Update Guide, as the sources were partly secondary.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119821 msrc.microsoft.com
• CVE.org record CVE-2026-119821 www.cve.org
• Strix CVE-2026-119821 (third-party summary) www.strix.ai
• Tenable: Microsoft November 2026 Patch Tuesday www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:53.