CVE-2026-27926

HighCVSS 7.0/10Last modified Oct 14, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Apr 14, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-279277.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Projected File System allows an authoCVE-2026-279288.7Improper input validation in Windows Hello allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-279297.0Time-of-check time-of-use (toctou) race condition in Windows LUAFV allows an authorized attacker to elevate privileges locally.CVE-2026-27939.8Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bCVE-2026-279305.5Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.CVE-2026-279315.5Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.CVE-2026-279327.5joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In 1.6.2 and earCVE-2026-279336.8Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. VersionCVE-2026-279347.5Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a lack of visibility checkCVE-2026-279356.5Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a vulnerability in an API CVE-2026-279365.3Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a restriction bypass allows reCVE-2026-279373.1October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerabil
CVE-2026-27926: High severity, CVSS 7.0 | Vulnix