Windows Task Scheduler: Command injection enables local privilege escalation

Summary

A flaw in the Windows Task Scheduler allows an authorized local user to elevate privileges because special characters are not neutralized before a command is executed (CWE-77). An attacker needs a local account with low privileges, and no user interaction is required. Successful exploitation can give the attacker full control over the system, with high impact on confidentiality, integrity and availability.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2: builds before 10.0.26100.9974
• Windows 11 Version 25H2: builds before 10.0.26200.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows 11 Version 26H2: builds before 10.0.26300.9974
• Windows Server 2022: builds before 10.0.20348.5870

Fixed in

• Install the Microsoft security update that brings the affected builds to the fixed versions listed above.
• KB numbers: Unknown.

Workaround

Unknown. No vendor mitigation has been confirmed.

Exploitation

• No known exploitation in the wild at the time of publication.
• No CISA KEV entry and no public proof of concept found.
• The CVSS exploit maturity is 'Unproven'.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Patch affected Windows systems as soon as the MSRC advisory confirms the KB and build numbers.
• Prioritize shared workstations, terminal or RDP servers, and systems where users have local logon.
• Reduce local administrator rights and remove unneeded local accounts.
• After patching, review scheduled tasks for unexpected entries running as SYSTEM.
• Re-check NVD and CISA KEV, as the record was still under analysis at publication.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record (CNA Microsoft) www.cve.org
• MSRC Security Update Guide msrc.microsoft.com
• Strix aggregator (third-party, verify against MSRC) www.strix.ai
• MITRE ATT&CK T1053.005 Scheduled Task (Atomic Red Team) www.atomicredteam.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:43.