CVE-2026-24296

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

VendorProductVersions
MicrosoftWindows 10 Version 1607>= 10.0.14393.0, < 10.0.14393.8957
MicrosoftWindows 10 Version 1809>= 10.0.17763.0, < 10.0.17763.8511
MicrosoftWindows 10 Version 21H2>= 10.0.19044.0, < 10.0.19044.7058
MicrosoftWindows 10 Version 22H2>= 10.0.19045.0, < 10.0.19045.7058
MicrosoftWindows 11 version 22H3>= 10.0.22631.0, < 10.0.22631.6783
MicrosoftWindows 11 Version 23H2>= 10.0.22631.0, < 10.0.22631.6783
MicrosoftWindows 11 Version 24H2>= 10.0.26100.0, < 10.0.26100.8037
MicrosoftWindows 11 Version 25H2>= 10.0.26200.0, < 10.0.26200.8037
MicrosoftWindows 11 version 26H1>= 10.0.28000.0, < 10.0.28000.1719
MicrosoftWindows Server 2012 R2>= 6.3.9600.0, < 6.3.9600.23074
MicrosoftWindows Server 2012 R2 (Server Core installation)>= 6.3.9600.0, < 6.3.9600.23074
MicrosoftWindows Server 2016>= 10.0.14393.0, < 10.0.14393.8957
MicrosoftWindows Server 2016 (Server Core installation)>= 10.0.14393.0, < 10.0.14393.8957
MicrosoftWindows Server 2019>= 10.0.17763.0, < 10.0.17763.8511
MicrosoftWindows Server 2019 (Server Core installation)>= 10.0.17763.0, < 10.0.17763.8511
MicrosoftWindows Server 2022>= 10.0.20348.0, < 10.0.20348.4893
MicrosoftWindows Server 2022, 23H2 Edition (Server Core installation)>= 10.0.25398.0, < 10.0.25398.2207
MicrosoftWindows Server 2025>= 10.0.26100.0, < 10.0.26100.32522
MicrosoftWindows Server 2025 (Server Core installation)>= 10.0.26100.0, < 10.0.26100.32522

References

Timeline

Published
Mar 10, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-242974.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kerberos allows an unauthorized attacCVE-2026-242995.3Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclCVE-2026-24306.4The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up tCVE-2026-243009.8Azure Front Door Elevation of Privilege VulnerabilityCVE-2026-243017.5Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to CVE-2026-243029.8Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network.CVE-2026-243039.6Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.CVE-2026-243049.9Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network.CVE-2026-243059.8Azure Entra ID Elevation of Privilege VulnerabilityCVE-2026-243069.8Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.CVE-2026-243077.5Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.CVE-2026-243087.5Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sens