CVE-2026-119853
Untrusted search path in Windows Remote Access API allows an authorized attacker to elevate privileges locally.
CVSS
7.8
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-426
Not enough EPSS history yet.
Untrusted search path in Windows Remote Access API allows an authorized attacker to elevate privileges locally.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-700948.8 HIG—
——0Untrusted search path in Visual Studio Code allows an unauthorized attacker to execute code over a network.4hCVE-2026-1260878.8 HIG—
——0Untrusted search path in the cross-user process launcher in Open Job Description (OpenJD) Sessions for Python before 0.11.0, as used in the AWS Deadline Cloud worker agent before 0.33.0, on Linux might allow an authenticated remote user with permission to submit jobs to a queue to execute arbitrary code as the worker agent OS user and obtain the AWS credentials held by the worker agent via a crafted job that modifies the PATH environment variable.
To remediate this issue, users of customer-managed fleets should upgrade the Deadline Cloud worker agent to version 0.33.0 or later, which includes OpenJD Sessions 0.11.0. Service-managed fleets were remediated service-side.4hCVE-2026-1199877.8 HIG—
——0Untrusted search path in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.4hCVE-2026-1198398.8 HIG—
——0Untrusted search path in Remote Desktop Client allows an unauthorized attacker to elevate privileges over a network.3hCVE-2026-1054947.8 HIG—
——0Untrusted search path in Azure NFS mount helper (aznfs) allows an authorized attacker to elevate privileges locally.4hCVE-2026-1193337.8 HIG3.0%
——1draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.8d