CVE-2026-103568

HighCVSS 7.8/10Last modified Oct 16, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-362

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Microsoft	Windows 10 Version 1607	>= 10.0.14393.0, < 10.0.14393.9612
Microsoft	Windows 10 Version 1809	>= 10.0.17763.0, < 10.0.17763.9376
Microsoft	Windows 10 Version 21H2	>= 10.0.19044.0, < 10.0.19044.7807
Microsoft	Windows 10 Version 22H2	>= 10.0.19045.0, < 10.0.19045.7807
Microsoft	Windows 11 version 23H2	>= 10.0.22631.0, < 10.0.22631.7652
Microsoft	Windows 11 Version 23H2	>= 10.0.22631.0, < 10.0.22631.7652
Microsoft	Windows 11 Version 24H2	>= 10.0.26100.0, < 10.0.26100.9711
Microsoft	Windows 11 Version 25H2	>= 10.0.26200.0, < 10.0.26200.9711
Microsoft	Windows 11 version 26H1	>= 10.0.28000.0, < 10.0.28000.3231
Microsoft	Windows 11 Version 26H2	>= 10.0.26300.0, < 10.0.26300.9711
Microsoft	Windows Server 2012	>= 6.2.9200.0, < 6.2.9200.26434
Microsoft	Windows Server 2012 (Server Core installation)	>= 6.2.9200.0, < 6.2.9200.26434
Microsoft	Windows Server 2012 R2	>= 6.3.9600.0, < 6.3.9600.23470
Microsoft	Windows Server 2012 R2 (Server Core installation)	>= 6.3.9600.0, < 6.3.9600.23470
Microsoft	Windows Server 2016	>= 10.0.14393.0, < 10.0.14393.9612
Microsoft	Windows Server 2016 (Server Core installation)	>= 10.0.14393.0, < 10.0.14393.9612
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.9376
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.17763.0, < 10.0.17763.9376
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.5761
Microsoft	Windows Server 2025	>= 10.0.26100.0, < 10.0.26100.33650
Microsoft	Windows Server 2025 (Server Core installation)	>= 10.0.26100.0, < 10.0.26100.33650

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103568

Timeline

Published: Oct 13, 2026
Last modified: Oct 16, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-1035697.5Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.CVE-2026-1035728.8Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an CVE-2026-1035758.8Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-1035766.5Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perfo CVE-2026-1035777.5Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1035786.8Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1035841.1Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMet CVE-2026-1035851.2Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearc CVE-2026-1035875.4QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, w CVE-2026-1035885.4QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module CVE-2026-1035895.4QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_CVE-2026-1035905.4QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. A