IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Windows ICS: Local privilege escalation via use after free

CVE-2026-119860High 7.0

← All vulnerabilities

Summary

A use-after-free vulnerability (CWE-416) in Windows Internet Connection Sharing (ICS) allows a locally authorized attacker to elevate privileges. An attacker who already has a standard user session, for example after a phishing compromise, could gain higher privileges on the affected system. Attack complexity is high and no user interaction is required. Microsoft fixed the flaw in the November 2026 updates.

Affected

  • Windows 10 Version 1607 and Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
  • Windows 10 Version 1809 and Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
  • Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
  • Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
  • Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
  • Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
  • Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
  • Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
  • Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
  • Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
  • Full list to be confirmed on the MSRC advisory

Fixed in

  • Install the November 2026 cumulative updates for the affected Windows version.
  • Fixed builds: see the affected build list above (first fixed build per product, as listed in the CVE record).
  • KB numbers: Unknown.

Workaround

Unknown.

  • If ICS is not required, disable it, especially on servers and shared workstations. This does not replace patching.

Exploitation

  • Rapid7 rates exploitation less likely and reports no detected exploitation.
  • CVSS temporal exploit maturity is Unproven (E:U).
  • No public proof of concept found in the searches performed; this is not proof that none exists.
  • CISA KEV status: Unknown (not verified).

Our recommendation

  • Install the November 2026 Windows security updates in the normal monthly cycle, and prioritize servers and systems where ICS is enabled.
  • Prioritize Windows 10 1607/1809 and Windows Server 2016/2019 systems, which are listed as affected.
  • Disable ICS on machines where it is not needed.
  • Verify the affected build and KB numbers on the MSRC advisory before rollout.
  • Check the CISA KEV catalog and monitor for public exploit code.

Information from Microsoft (Patch Tuesday November 2026)

Severity (Microsoft)
Important
Impact
Elevation of privilege – Windows Internet Connection Sharing (ICS)
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5131085, KB5131096, KB5131090, KB5131087, KB5132061, KB5132043

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:38.

Original description (NVD)

Use after free in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed