CVE-2026-20934CWE-362

CVE-2026-20934

High · published January 13, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
54.3
In the wild
Unconfirmed
What it is

⚡ A race condition in Windows SMB Server lets an authorized attacker gain elevated privileges with just the right timing! ⏱️ Think of it like two chefs trying to use the same frying pan at the same time; if one chef doesn't wait for the pan to cool down, they might get control over the whole kitchen and ruin both dishes! 🍳 An attacker could exploit this flaw to take control over the server, allowing them to elevate their privileges and access sensitive data or even manipulate critical system functions. This could lead to unauthorized data breaches or system compromises, causing chaos on your network! 🔥

Put simply

Think of it like two chefs trying to use the same frying pan at the same time; if one chef doesn't wait for the pan to cool down, they might get control over the whole kitchen and ruin both dishes! 🍳 The vulnerability arises from improper synchronization in the shared resource management of the SMB Server, allowing concurrent execution that can be manipulated by an attacker to gain higher access rights.

What to do

An attacker could exploit this flaw to take control over the server, allowing them to elevate their privileges and access sensitive data or even manipulate critical system functions. This could lead to unauthorized data breaches or system compromises, causing chaos on your network! 🔥 To mitigate this, ensure that your systems are updated with the latest patches from Microsoft. Review your network configurations and user permissions carefully to limit unauthorized access, and consider monitoring for unusual activities. Stay ahead of potential threats! 🛡️ You’ve got this! With these steps, you can secure your systems and maintain your hero status in cybersecurity! 🚀

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00745 · 54.3th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-01-13T23:16Z
Affected products (23)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.878310.0.14393.8783
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:56Z
    Windows SMB Server Elevation of Privilege Vulnerability
    cvelistv5