CVE-2026-23671

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362 CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Mar 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-236727.8Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability CVE-2026-236737.8Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.CVE-2026-236747.5Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-236788.8Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerability in the traceroute CVE-2026-236795.5libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a ma CVE-2026-23687.1An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of interceptin CVE-2026-236814.3Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific functi CVE-2026-236834.3SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in es CVE-2026-236845.9A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in CVE-2026-236854.4Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could CVE-2026-236863.4Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could s CVE-2026-236878.8SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed mes