Microsoft Windows Win32k: Elevation of privilege via missing authorization

Summary

A missing authorization check in the Win32k kernel component of Windows allows a locally authenticated user to elevate privileges. An attacker who already has a low-privileged account or code execution on the machine could gain higher rights, potentially up to SYSTEM. Exploitation requires high attack complexity and no vendor-confirmed exploit is known.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846 (unconfirmed, verify with MSRC)
• Windows 11 23H2: builds before 10.0.22631.7711 (unconfirmed, verify with MSRC)
• Windows 11 24H2 and 25H2: builds before 10.0.26100.9974 and 10.0.26200.9974 (unconfirmed, verify with MSRC)
• Windows 11 26H1: builds before 10.0.28000.3501 (unconfirmed, verify with MSRC)
• Windows 11 26H2: builds before 10.0.26300.9974 (unconfirmed, verify with MSRC)
• Windows Server 2022: builds before 10.0.20348.5870 (unconfirmed, verify with MSRC)

Fixed in

• Security update from Microsoft for the affected builds (November 2026 Patch Tuesday). KB article numbers: Unknown.
• Exact fixed builds for each edition should be confirmed in the MSRC advisory.

Workaround

• Unknown. No vendor or third-party mitigation was identified. Patching is the expected remedy.

Exploitation

• Microsoft exploit code maturity is 'Unproven' (E:U), so no working exploit is known to the vendor.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• No CISA KEV entry, no in-the-wild exploitation report and no public proof of concept found at the time of research.

Our recommendation

• Install the November 2026 Microsoft security update on all affected systems, with priority on multi-user servers and Remote Desktop/terminal servers.
• Verify the fixed build numbers in the MSRC advisory before rollout.
• Restrict local logon rights and limit low-privileged accounts on shared servers.
• Monitor for public exploit reports and re-check CISA KEV after publication.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-119827 msrc.microsoft.com
• CVE.org Record CVE-2026-119827 www.cve.org
• VulDB entry 434171 vuldb.com
• Strix CVE-2026-119827 (third-party mirror) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:45.