CVE-2026-20861

HighCVSS 7.8/10Last modified Jul 30, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-362 CWE-415 CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2026
Last modified: Jul 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-208625.5Exposure of sensitive information to an unauthorized actor in Windows Management Services allows an authorized attacker to disclose informat CVE-2026-208637.0Double free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.CVE-2026-208647.8Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.CVE-2026-208657.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-208667.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authori CVE-2026-208677.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authori CVE-2026-208688.8Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a networ CVE-2026-208697.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Local Session Manager (LSM) allows an CVE-2026-20879.8A flaw has been found in SourceCodester Online Class Record System 1.0. Affected by this issue is some unknown functionality of the file /ad CVE-2026-208707.8Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.CVE-2026-208717.8Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally.CVE-2026-208726.5External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.