Microsoft Windows Installer: Elevation of privilege via improper access control

Summary

A local authorized user can exploit improper access control in Windows Installer to gain higher privileges on affected Windows 10, Windows 11 and Windows Server systems. The attack needs an existing local account and no user interaction, but the impact on confidentiality, integrity and availability is high. The NVD entry is still awaiting analysis, and the CVE record uses CWE-22 while the vendor text describes access control, so the root cause is not fully confirmed.

Affected

• Windows 10 Version 1607, 1809, 21H2 and 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2
• Windows Server 2016, 2019 and 2022 (including Server Core installations)
• Build ranges per the official CVE record; verify the exact builds on the MSRC advisory, as third-party sources differ on some editions

Fixed in

• Windows 10 1607: 10.0.14393.9688
• Windows 10 1809: 10.0.17763.9487
• Windows 10 21H2 and 22H2: 10.0.19044.7846 and 10.0.19045.7846
• Windows 11 23H2: 10.0.22631.7711
• Windows 11 24H2 and 25H2: 10.0.26100.9974 and 10.0.26200.9974
• Windows 11 26H1: 10.0.28000.3501
• Windows 11 26H2: 10.0.26300.9974
• Windows Server 2016 and 2019: 10.0.14393.9688 and 10.0.17763.9487
• Windows Server 2022: 10.0.20348.5870
• Patch: November 10, 2026 Patch Tuesday update; KB numbers unknown

Workaround

Unknown.

Exploitation

• Microsoft marks the vulnerability as not exploited.
• Tenable lists an exploitability rating of 'Exploitation More Likely', which is a rating and not confirmed exploitation in the wild.
• Talos reports one exploited item in the November release, but its wording is ambiguous; Tenable attributes the exploited item to a different Outlook flaw (CVE-2026-124194).
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept known.

Our recommendation

• Install the November 2026 cumulative update on all affected Windows 10, Windows 11 and Windows Server systems, prioritising multi-user systems and terminal servers.
• Verify the installed build against the fixed build on the MSRC advisory.
• Review local accounts and limit local logon rights on servers and shared workstations.
• Monitor for changes in exploitability status, as the sources disagree and the NVD analysis is pending.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119903 msrc.microsoft.com
• CVE Record CVE-2026-119903 www.cve.org
• Tenable: November 2026 Patch Tuesday www.tenable.com
• Talos: Microsoft Patch Tuesday for November 2026 blog.talosintelligence.com
• Strix: CVE-2026-119903 (third-party aggregator) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:43.