CVE-2026-20874CWE-362CWE-416

CVE-2026-20874

High · published January 13, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
20.8
In the wild
Unconfirmed
What it is

⚡ A sneaky race condition in Windows Management Services could let an authorized attacker level up their privileges locally — just a dash to the finish line away from critical access! Think of it like two chefs trying to prepare dishes in a shared kitchen without coordinating their tasks. If one chef rushes in to claim the last vital ingredient before the other finishes chopping, it can lead to a spectacular culinary disaster — or in this case, an unauthorized privilege elevation! If this vulnerability is exploited, an attacker could gain elevated privileges on the system, potentially allowing them to execute malicious commands, manipulate data, or gain control over sensitive resources. This could lead to devastating consequences, including data breaches or system compromises. 🔥

Put simply

Think of it like two chefs trying to prepare dishes in a shared kitchen without coordinating their tasks. If one chef rushes in to claim the last vital ingredient before the other finishes chopping, it can lead to a spectacular culinary disaster — or in this case, an unauthorized privilege elevation! This race condition results from improper synchronization when multiple processes share the same resource, allowing an attacker to exploit the timing differences and escalate their privileges locally.

What to do

If this vulnerability is exploited, an attacker could gain elevated privileges on the system, potentially allowing them to execute malicious commands, manipulate data, or gain control over sensitive resources. This could lead to devastating consequences, including data breaches or system compromises. 🔥 To mitigate this risk, ensure that your Windows Management Services are updated to the latest version. Implement strict access controls and monitor system logs for any suspicious activities. Regularly audit your systems for compliance with best security practices. 🛡️ You've got this! By taking these steps, you're on your way to securing your systems against this vulnerability. 🚀

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00293 · 20.8th percentile
Weaknesses
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-416 · Use After Free
Published
2026-01-13T23:16Z
Affected products (11)
ProductVersionsFixed in
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:57Z
    Windows Management Services Elevation of Privilege Vulnerability
    cvelistv5