Windows Connection Manager Service: Use after free allows privilege escalation

Summary

A use-after-free flaw in the Windows Connection Manager Service allows an authorized local user to elevate privileges. An attacker who already has a local, authenticated foothold, such as a compromised user account or malware running as a normal user, could gain SYSTEM rights with high impact on confidentiality, integrity and availability. The vulnerability is not directly reachable from the internet, and the CVSS base score is 7.0 (High).

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 before 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (10.0.14393.0 before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (10.0.17763.0 before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 before 10.0.20348.5870)

Fixed in

• Fixed in Microsoft's November 2026 Patch Tuesday updates.
• First fixed builds: see the affected list above (the 'before' values are the first fixed builds).
• KB number: Unknown. Confirm the exact builds and KB articles in the MSRC advisory before rollout.

Workaround

• Unknown. No workaround is described by Microsoft. Patching is the remedy.

Exploitation

• Microsoft's assessment at publication: exploit maturity unproven (E:U).
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not known to be exploited in the wild; not found in the CISA KEV catalog.
• No public proof of concept found.

Our recommendation

• Install the November 2026 Windows security updates on all affected systems, starting with Windows 10 hosts on older builds and shared or multi-user systems.
• Verify the installed build afterwards and check the support status of Windows 10 builds on Microsoft's lifecycle pages.
• Limit local logon and admin rights, and monitor endpoints for signs of privilege escalation.
• Monitor for changes in exploitation status after publication.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96043 msrc.microsoft.com
• CVE Record CVE-2026-96043 (CVE.org) www.cve.org
• Action1: Patch Tuesday November 2026 www.action1.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:46.