Brief Summary: Windows IIS CVE-2026-119961, a Race Condition Leading to Use After Free and Remote Code Execution

Introduction

Microsoft's November 10, 2026 Patch Tuesday release fixed a remote code execution flaw in Windows Internet Information Services (IIS). Microsoft says an unauthenticated attacker can reach it over the network with no user interaction. The fix ships only inside the monthly Windows cumulative updates. The affected list spans Windows Server 2016 through Windows Server 2025 plus several Windows 10 and Windows 11 releases, so most of the practical work for defenders is verifying builds across a large fleet.

Technical information

Root cause

Microsoft describes CVE-2026-119961 as "concurrent execution using shared resource with improper synchronization ('race condition')" in IIS that "allows an unauthorized attacker to execute code over a network." The CVE record assigns two weaknesses:

• CWE-362: a race condition, where two threads use a shared resource without proper synchronization.
• CWE-416: use after free.

Together these point to a familiar bug class. One thread in the IIS request-handling path frees or recycles an object while another thread still holds a pointer to it. If an attacker wins that timing window, the stale pointer can end up referencing memory the attacker controls.

Microsoft has not said which IIS module or code path is affected. IIS is a closed-source Windows component, so there is no public commit, diff, or vulnerable code to examine. The advisory also does not explain how the two CWE classifications relate in this specific implementation. The description above is the general shape of the bug class, not a confirmed reconstruction of Microsoft's code.

Severity and CVSS profile

Microsoft rates the impact Critical and assigns a CVSS 3.1 base score of 8.1. NVD displays the Microsoft CNA score as 8.1 High and notes that NVD has not supplied its own assessment.

Attack complexity is the main limit on the score. Without the race requirement, an unauthenticated network RCE with high impact on all three properties would score higher.

Attack flow

Microsoft's FAQ gives only a short attack description. Based on that material:

1. The attacker targets a network-reachable system running an affected IIS service.
2. The attacker sends a specially crafted packet to the service. No credentials and no user interaction are needed.
3. Exploitation succeeds only if the attacker wins the race condition. Per the CWE classification, this means hitting the window where a shared object is freed while another thread still uses it.
4. If the race is won, the attacker can execute code on the target.

The reviewed sources say nothing about how the packet is built, how the timing is achieved, or what a reliable exploit would need. We do not speculate on those points.

Exploitation status

Microsoft's advisory says the issue was not publicly disclosed and was not exploited. It rates exploitability "Less Likely" and exploit code maturity "Unproven". Senserva reports that the CVE was not listed in CISA's Known Exploited Vulnerabilities catalog. No threat actor is attributed. Microsoft's acknowledgements credit GraVity0, 6ucy and Dawnflare under coordinated vulnerability disclosure. These statements show what has been reported. They do not rule out private testing or unreported activity.

Patch information

Microsoft fixed CVE-2026-119961 in its November 10, 2026 Patch Tuesday release. The fix is compiled code inside the monthly Windows cumulative updates, and there is no standalone IIS package. A system is patched once its OS build is at or above the build MSRC lists for its release:

For Windows Server 2025 and Windows 11 24H2, 25H2 and 26H2, MSRC lists two KBs, each with its own qualifying build. This probably reflects two alternate servicing packages for the same fix, such as a standard cumulative update and a hotpatch-style update. Check which servicing track each host is on before deciding which KB applies.

Microsoft has not described the code change. Fixes for this bug class usually add or widen a lock around the shared object, add reference counting so the object cannot be freed while still in use, or both. Treat that as an educated guess about the likely approach, not a confirmed description of Microsoft's fix.

The Microsoft advisory does not list a separate workaround or mitigation. Installing the update is the only remediation the advisory supports.

Verifying the fix

The fix is compiled into the OS, so the build number is the reliable check:

• Run winver, or read the UBR value under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion, and compare the result with the table above.
• Confirm that the listed KB is installed on the host.
• Download packages from the Microsoft Update Catalog using the links on the MSRC advisory.

Affected systems and versions

The CNA-supplied version data in NVD matches the MSRC fixed builds. Each affected product is vulnerable from its base build up to, but not including, the fixed build:

• Windows Server 2025, including Server Core installations: builds before 10.0.26100.33822 (NVD uses this higher build as the boundary. MSRC also lists 10.0.26100.33730 for KB5131077.)
• Windows Server 2022, including Server Core installations: builds before 10.0.20348.5870
• Windows Server 2019, including Server Core installations, and Windows 10 version 1809: builds before 10.0.17763.9487
• Windows Server 2016, including Server Core installations, and Windows 10 version 1607: builds before 10.0.14393.9688
• Windows 10 version 21H2: builds before 10.0.19044.7846
• Windows 10 version 22H2: builds before 10.0.19045.7846
• Windows 11 version 23H2: builds before 10.0.22631.7711
• Windows 11 version 24H2: builds before 10.0.26100.9974 / 10.0.26100.9911, depending on the applicable KB
• Windows 11 version 25H2: builds before 10.0.26200.9974 / 10.0.26200.9911, depending on the applicable KB
• Windows 11 version 26H2: builds before 10.0.26300.9974 / 10.0.26300.9911, depending on the applicable KB
• Windows 11 version 26H1: builds before 10.0.28000.3501

Confirm the exact build and architecture for each system in Microsoft's advisory before marking it as patched.

References

• NVD: CVE-2026-119961
• CVE Record: CVE-2026-119961
• Microsoft Security Update Guide: CVE-2026-119961, Windows Internet Information Services Remote Code Execution Vulnerability
• Zero Day Initiative: The November 2026 Security Update Review
• Senserva: CVE-2026-119961
• VulDB: CVE-2026-119961 in Windows
• Microsoft Learn: IIS Web Server Overview
• Microsoft Learn: Internet Information Services (IIS) Lifecycle
• Microsoft Learn: Changes in Security Between IIS 6.0 and IIS 7 and Above
• W3Techs: Usage Statistics and Market Share of Microsoft IIS, November 2026