CVE-2026-20866CWE-362

CVE-2026-20866

High · published January 13, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
20.8
In the wild
Unconfirmed
What it is

⚡ A race condition in Windows Management Services could let an attacker elevate their privileges locally, and it’s all about who gets there first! 🔥 Think of this like two chefs trying to add ingredients to the same pot simultaneously without a proper system in place. If one chef jumps in before the other can finish their task, they could spoil the entire dish! 🍲 This means an attacker could potentially gain control over sensitive parts of the system, allowing them to manipulate settings, access confidential data, or even install malicious software. The implications could range from disrupting service to full system compromise — a true nightmare scenario! 😱⚠️

Put simply

Think of this like two chefs trying to add ingredients to the same pot simultaneously without a proper system in place. If one chef jumps in before the other can finish their task, they could spoil the entire dish! 🍲 This vulnerability arises from improper synchronization when multiple processes try to access shared resources concurrently, leading to a situation where an attacker can exploit timing to elevate their permissions.

What to do

This means an attacker could potentially gain control over sensitive parts of the system, allowing them to manipulate settings, access confidential data, or even install malicious software. The implications could range from disrupting service to full system compromise — a true nightmare scenario! 😱⚠️ To mitigate this risk, ensure your system is patched and updated to the latest version of Windows Management Services. Additionally, monitor permissions closely and employ stricter access controls to prevent unauthorized attempts at privilege escalation. You've got this! Stay vigilant, and by following these steps, you'll bolster your defenses and keep your system secure. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00293 · 20.8th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-01-13T23:16Z
Affected products (11)
ProductVersionsFixed in
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:56Z
    Windows Management Services Elevation of Privilege Vulnerability
    cvelistv5