Windows Task Scheduler: Local privilege escalation due to missing authorization

Summary

A missing authorization check in the Windows Task Scheduler allows a local user with an existing low-privileged account to elevate privileges. Successful exploitation can grant full SYSTEM-level control of the affected machine. No user interaction is required, and the vulnerability is not reachable from the internet.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9612)
• Windows 10 Version 1809 (builds before 10.0.17763.9376)
• Windows 10 Version 21H2 (builds before 10.0.19044.7807)
• Windows 10 Version 22H2 (builds before 10.0.19045.7807, unverified third-party data)
• Windows 11 Version 23H2 (builds before 10.0.22631.7652, unverified third-party data)
• Windows 11 Versions 24H2, 25H2, 26H1, 26H2 and Windows Server 2012, 2012 R2 and 2016 (listed in the CVE record, fixed builds not confirmed)
• Full product list: Unknown, to be confirmed on MSRC.

Fixed in

• Cumulative updates with builds 10.0.14393.9612, 10.0.17763.9376, 10.0.19044.7807 or later, per the CVE record.
• Further fixed builds listed by the CVE record: to be confirmed on the MSRC advisory.
• KB numbers: Unknown.

Workaround

• Unknown. No vendor workaround was found. Patching is the only confirmed remediation.

Exploitation

• Not known to be exploited in the wild.
• Not listed in CISA KEV.
• No public proof-of-concept exploit found; this may change quickly.
• CVSS exploit maturity: unproven (E:U). CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Inventory all Windows 10, 11 and Server hosts and identify exact builds (winver).
• Confirm the fixed builds on the MSRC advisory and install the cumulative update via Windows Update or WSUS, prioritising shared, multi-user, RDS and terminal servers.
• Replace unsupported builds such as 1607, 1809 and 21H2 where possible, as they will not receive this fix.
• Monitor for unusual scheduled-task creation or changes and review least-privilege access for local accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-96845 www.cve.org
• MSRC Security Update Guide msrc.microsoft.com
• OffSeq threat radar (unverified tracker data) radar.offseq.com
• Strix CVE data (unverified) www.strix.ai
• CISA KEV alert 13 Oct 2026 (context only) www.cisa.gov

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:26.