CVE-2026-20869

HighCVSS 7.0/10Last modified Jul 30, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Local Session Manager (LSM) allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

VendorProductVersions
MicrosoftWindows 10 Version 1607>= 10.0.14393.0, < 10.0.14393.8783
MicrosoftWindows 10 Version 1809>= 10.0.17763.0, < 10.0.17763.8276
MicrosoftWindows 10 Version 21H2>= 10.0.19044.0, < 10.0.19044.6809
MicrosoftWindows 10 Version 22H2>= 10.0.19045.0, < 10.0.19045.6809
MicrosoftWindows 11 version 23H2>= 10.0.22631.0, < 10.0.22631.6491
MicrosoftWindows 11 Version 23H2>= 10.0.22631.0, < 10.0.22631.6491
MicrosoftWindows 11 Version 24H2>= 10.0.26100.0, < 10.0.26100.7623
MicrosoftWindows 11 Version 25H2>= 10.0.26200.0, < 10.0.26200.7623
MicrosoftWindows Server 2008 R2 Service Pack 1>= 6.1.7601.0, < 6.1.7601.28117
MicrosoftWindows Server 2008 R2 Service Pack 1 (Server Core installation)>= 6.1.7601.0, < 6.1.7601.28117
MicrosoftWindows Server 2008 Service Pack 2>= 6.0.6003.0, < 6.0.6003.23717
MicrosoftWindows Server 2008 Service Pack 2 (Server Core installation)>= 6.0.6003.0, < 6.0.6003.23717
MicrosoftWindows Server 2012>= 6.2.9200.0, < 6.2.9200.25868
MicrosoftWindows Server 2012 (Server Core installation)>= 6.2.9200.0, < 6.2.9200.25868
MicrosoftWindows Server 2012 R2>= 6.3.9600.0, < 6.3.9600.22968
MicrosoftWindows Server 2012 R2 (Server Core installation)>= 6.3.9600.0, < 6.3.9600.22968
MicrosoftWindows Server 2016>= 10.0.14393.0, < 10.0.14393.8783
MicrosoftWindows Server 2016 (Server Core installation)>= 10.0.14393.0, < 10.0.14393.8783
MicrosoftWindows Server 2019>= 10.0.17763.0, < 10.0.17763.8276
MicrosoftWindows Server 2019 (Server Core installation)>= 10.0.17763.0, < 10.0.17763.8276
MicrosoftWindows Server 2022>= 10.0.20348.0, < 10.0.20348.4648
MicrosoftWindows Server 2022, 23H2 Edition (Server Core installation)>= 10.0.25398.0, < 10.0.25398.2092
MicrosoftWindows Server 2025>= 10.0.26100.0, < 10.0.26100.32230
MicrosoftWindows Server 2025 (Server Core installation)>= 10.0.26100.0, < 10.0.26100.32230

References

Timeline

Published
Jan 13, 2026
Last modified
Jul 30, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-20879.8A flaw has been found in SourceCodester Online Class Record System 1.0. Affected by this issue is some unknown functionality of the file /adCVE-2026-208707.8Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.CVE-2026-208717.8Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally.CVE-2026-208726.5External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.CVE-2026-208737.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authoriCVE-2026-208747.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authoriCVE-2026-208757.5Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over CVE-2026-208766.7Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locallCVE-2026-208777.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-208787.4Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of serCVE-2026-208798.3Out-of-bounds write for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1: Device DriversCVE-2026-20889.8A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/accepted-
CVE-2026-20869: High severity, CVSS 7.0 | Vulnix