CVE-2026-24296

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published: Mar 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-242974.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kerberos allows an unauthorized attac CVE-2026-242995.3Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to discl CVE-2026-24306.4The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up t CVE-2026-243009.8Azure Front Door Elevation of Privilege Vulnerability CVE-2026-243017.5Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to CVE-2026-243029.8Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network.CVE-2026-243039.6Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.CVE-2026-243049.9Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network.CVE-2026-243059.8Azure Entra ID Elevation of Privilege Vulnerability CVE-2026-243069.8Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.CVE-2026-243077.5Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.CVE-2026-243087.5Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sens