Microsoft Windows Installer: Elevation of privilege via missing authorization

Summary

Missing authorization in the Windows Installer component allows an authorized local attacker to elevate privileges on affected Windows 10, Windows 11 and Windows Server systems. The attacker needs an existing low-privileged local account or process and user interaction, and the attack is hard to carry out. Successful exploitation could give the attacker high confidentiality, integrity and availability impact on the system.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2016 and Server Core installation (builds before 10.0.14393.9688)
• Windows Server 2019 and Server Core installation (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)
• Note: the affected list is taken from the CVE record; the full list and KB numbers are to be confirmed on the MSRC advisory.

Fixed in

• Install the November 2026 cumulative update from Microsoft for your Windows version.
• Minimum fixed builds per the CVE record: 10.0.14393.9688 (1607 and 2016), 10.0.17763.9487 (1809 and 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.28000.3501 (26H1), 10.0.26300.9974 (26H2), 10.0.20348.5870 (2022).
• Verify the fixed builds and KB numbers on the MSRC advisory before rollout.

Workaround

Unknown.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, technical impact total.
• Rapid7 rates the flaw as Exploitation Less Likely and not publicly disclosed.
• No public proof of concept found.

Our recommendation

• Install the November 2026 cumulative update in the normal patch cycle, and earlier on multi-user terminal servers and on Windows Server 2016 and 2019 systems.
• Patch the Windows Installer component together with other Windows Installer elevation of privilege fixes from October and November 2026.
• Check the MSRC advisory for interim guidance, as no workaround is documented.
• Monitor for unusual privilege escalation and new local accounts or processes, and check the CISA KEV catalog and NVD once analysis is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center advisory CVE-2026-119852 msrc.microsoft.com
• CVE.org CNA record CVE-2026-119852 www.cve.org
• Rapid7 Patch Tuesday November 2026 www.rapid7.com
• Strix CVE-2026-119852 (unverified aggregator) www.strix.ai
• Senserva KB5131085 summary (third party) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:32.