IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Windows Internet Connection Sharing (ICS): Local privilege escalation

CVE-2026-119861High 7.0

← All vulnerabilities

Summary

A flaw in the Windows Internet Connection Sharing (ICS) feature allows an authorized local user with low privileges to elevate their privileges. The CNA record describes a heap-based buffer overflow, but it lists CWE-416 (Use After Free), so the weakness type is not yet confirmed. Exploitation requires local access, high attack complexity and a valid low-privilege account. The CVSS rating is high for confidentiality, integrity and availability, and no exploitation is known.

Affected

  • Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9688
  • Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
  • Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
  • Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846 (only from a secondary aggregator, not confirmed by Microsoft)
  • Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711 (only from a secondary aggregator, not confirmed by Microsoft)
  • Windows 11 Version 24H2, 25H2, 26H1 and 26H2 and Windows Server 2016, 2019 and 2022 are listed in the CNA record; verify the exact builds on MSRC
  • Windows 11 and Windows Server entries are not fully confirmed in the sources read; check MSRC

Fixed in

  • Install the Microsoft security update for November 2026 (the release this CVE was published with).
  • Fixed builds per the CNA record: 10.0.14393.9688 (1607), 10.0.17763.9487 (1809), 10.0.19044.7846 (21H2), 10.0.22631.7711 (23H2, aggregator data), 10.0.26100.9974 (24H2), 10.0.20348.5870 (Server 2022).
  • Confirm the fixed builds on MSRC before rollout.

Workaround

  • No Microsoft-specific workaround is known.
  • If patching is delayed, disable Internet Connection Sharing or NAT features where they are not needed.
  • Restrict untrusted traffic to hosts that use these features.

Exploitation

  • Not listed in CISA KEV at the time of the sources.
  • The CVE record's temporal vector is E:U (Unproven exploit), so no exploit code is known.
  • CISA SSVC: exploitation none, not automatable, total technical impact.
  • No public proof-of-concept was found; this is a search gap, not confirmed absence.

Our recommendation

  • Confirm the affected builds on MSRC before patching.
  • Check whether ICS is enabled on your Windows systems and disable it where it is not needed.
  • Patch gateways and hosts that share a connection first, then the rest of the fleet.
  • Review the related ICS flaws CVE-2026-72926 and CVE-2026-119859.
  • Monitor NVD for updated CWE data and for a CISA KEV listing.

Information from Microsoft (Patch Tuesday November 2026)

Severity (Microsoft)
Important
Impact
Elevation of privilege – Windows Internet Connection Sharing (ICS)
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:41.

Original description (NVD)

Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed