Windows Sandbox Elevation of Privilege Vulnerability

Summary

Vulnerabilities 1

• High 7.8
  CVE-2026-119906

  Windows Sandbox Elevation of Privilege Vulnerability

  Improper neutralization of special elements used in an os command ('os command injection') in Windows Sandbox allows an authorized attacker to elevate privileges locally.

  Microsoft Windows Sandbox Windows
  Nov 10, 2026

Revision history

1. 2026-11-10 #1

   Information published.

References

• CVE-2026-119906 Windows Sandbox Elevation of Privilege Vulnerability - HTML
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119906
• Microsoft Exploitability Index
  https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
• Microsoft Support Lifecycle
  https://support.microsoft.com/lifecycle
• Common Vulnerability Scoring System
  https://www.first.org/cvss