CVE-2026-20873CWE-362CWE-416

CVE-2026-20873

High · published January 13, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
20.8
In the wild
Unconfirmed
What it is

⚡ A sneaky race condition in Windows Management Services lets authorized attackers elevate their privileges with just a clever timing move! Think of it as two chefs trying to grab the last piece of cake from a shared fridge — if one chef is just a second faster, they get the treat while the other is left empty-handed. Here, the lack of proper synchronization means the winner could be anyone with access! If exploited, an attacker could gain elevated privileges on the system, allowing them to perform actions they shouldn’t have access to. This could lead to unauthorized data access, modification, or even complete control over the affected system. The consequences could be absolutely devastating!

Put simply

Think of it as two chefs trying to grab the last piece of cake from a shared fridge — if one chef is just a second faster, they get the treat while the other is left empty-handed. Here, the lack of proper synchronization means the winner could be anyone with access! This vulnerability arises from improper synchronization in concurrent execution, allowing an attacker with valid access to interfere with the expected flow of operations, potentially gaining elevated privileges on the system.

What to do

If exploited, an attacker could gain elevated privileges on the system, allowing them to perform actions they shouldn’t have access to. This could lead to unauthorized data access, modification, or even complete control over the affected system. The consequences could be absolutely devastating! To remediate this, ensure you apply the latest security updates from Microsoft as soon as possible. Review your system configurations and restrict access to sensitive areas of your systems until the patch is in place. Regularly monitor for any unusual activity related to privilege escalations, too! You've got this! Act quickly and confidently to secure your systems — let's keep those cyber villains at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00293 · 20.8th percentile
Weaknesses
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-416 · Use After Free
Published
2026-01-13T23:16Z
Affected products (11)
ProductVersionsFixed in
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:57Z
    Windows Management Services Elevation of Privilege Vulnerability
    cvelistv5