CVE-2026-119890

Windows DHCP Server Denial of Service Vulnerability

Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over a network.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 and 4 more

CVE-2026-119905

Windows DNS Spoofing Vulnerability

Improper input validation in Windows DNS allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 4.9 Medium EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 and 4 more

CVE-2026-119900

Windows NTFS Elevation of Privilege Vulnerability

Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-119908

Windows Storage Spaces Controller Remote Code Execution Vulnerability

Integer underflow (wrap or wraparound) in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 23h2 Windows 11 23h2 Windows 11 24h2 and 10 more

CVE-2026-119912

Windows Kernel Elevation of Privilege Vulnerability

Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-119913

Windows Print Spooler Components Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-119914

Windows Setup and Deployment Elevation of Privilege Vulnerability

Improper restriction of communication channel to intended endpoints in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-119916

Windows Input System Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Input System allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 17 more

CVE-2026-119917

Windows Distributed Transaction Coordinator Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Distributed Transaction Coordinator allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-119919

Windows Distributed Transaction Coordinator Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Distributed Transaction Coordinator allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-119848

Windows Message Queuing Denial of Service Vulnerability

Improper input validation in Windows Message Queuing allows an authorized attacker to deny service over a network.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-119851

Windows Storage Spaces Controller Elevation of Privilege Vulnerability

Time-of-check time-of-use (toctou) race condition in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-119853

Remote Access API Elevation of Privilege Vulnerability

Untrusted search path in Windows Remote Access API allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-119865

Windows Installer Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-119868

Windows Kernel Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 and 4 more

CVE-2026-119869

Windows Failover Cluster Elevation of Privilege Vulnerability

Use after free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 and 4 more

CVE-2026-119871

Windows IP Translation Configuration Service Elevation of Privilege Vulnerability

Use after free in Windows IP Translation Configuration Service allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-119883

Data Deduplication Security Feature Bypass Vulnerability

Improper authorization in Data Deduplication allows an authorized attacker to bypass a security feature locally.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 and 4 more

CVE-2026-119887

Windows Installer Information Disclosure Vulnerability

Use of uninitialized resource in Windows Installer allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-119825

Win32k Information Disclosure Vulnerability

Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more