CVE-2026-20918

HighCVSS 7.8/10Last modified Jul 30, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-362CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Jan 13, 2026
Last modified
Jul 30, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-209197.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacCVE-2026-20927.7A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted asseCVE-2026-209207.8Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.CVE-2026-209217.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacCVE-2026-209227.8Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.CVE-2026-209237.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-209247.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-209256.5External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.CVE-2026-209267.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacCVE-2026-209275.3Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacCVE-2026-209284.6Improper removal of sensitive information before storage or transfer in Windows Recovery Environment Agent allows an unauthorized attacker tCVE-2026-209297.5Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.
CVE-2026-20918: High severity, CVSS 7.8 | Vulnix