CVE-2026-20869CWE-362

CVE-2026-20869

High · published January 13, 2026

CVSS v3.1
7.0
EPSS
0%
Percentile
20.8
In the wild
Unconfirmed
What it is

⚡ A race condition in the Windows Local Session Manager could let an authorized attacker take the wheel and speed past security barriers! Think of it like two chefs fighting for the same stove at a busy restaurant — if one chef overcooks a dish while the other is busy chopping, chaos ensues in the kitchen. Similarly, this vulnerability allows multiple processes to fight for control over shared resources without proper coordination, leading to potential privilege escalation. An attacker could use this flaw to elevate their privileges locally, gaining access to sensitive system operations and potentially compromising the system's integrity. This means they could manipulate system settings, install malicious software, or even bypass security measures, putting the entire system at risk!

Put simply

Think of it like two chefs fighting for the same stove at a busy restaurant — if one chef overcooks a dish while the other is busy chopping, chaos ensues in the kitchen. Similarly, this vulnerability allows multiple processes to fight for control over shared resources without proper coordination, leading to potential privilege escalation. This vulnerability stems from improper synchronization during concurrent execution in the Windows Local Session Manager, allowing an authorized attacker to exploit race conditions and gain elevated access over the system.

What to do

An attacker could use this flaw to elevate their privileges locally, gaining access to sensitive system operations and potentially compromising the system's integrity. This means they could manipulate system settings, install malicious software, or even bypass security measures, putting the entire system at risk! To mitigate this threat, ensure your system is updated with the latest security patches from Microsoft. Additionally, regularly review user permissions and limit access to sensitive resources to only those that absolutely need it. Always apply the principle of least privilege! You've got this! With timely updates and a little vigilance, you can keep your systems safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00293 · 20.8th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-01-13T23:16Z
Affected products (19)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.878310.0.14393.8783
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:56Z
    Windows Local Session Manager (LSM) Elevation of Privilege Vulnerability
    cvelistv5