CVE-2026-70582

MediumCVSS 6.4/10Last modified Sep 28, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362 CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Sep 8, 2026
Last modified: Sep 28, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-705837.8Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally.CVE-2026-705847.8Access of resource using incompatible type ('type confusion') in Windows Core Messaging allows an authorized attacker to elevate privileges CVE-2026-705857.0Use after free in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to execute code locally.CVE-2026-705868.8Heap-based buffer overflow in Windows Paint allows an unauthorized attacker to execute code over a network.CVE-2026-705877.5Improper null termination in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.CVE-2026-705885.0Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanit CVE-2026-705894.8Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offe CVE-2026-70595.3A vulnerability was found in 666ghj MiroFish up to 0.1.2. This affects the function get_simulation_posts of the file backend/app/api/simulat CVE-2026-705904.8Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff use CVE-2026-705914.1Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed CVE-2026-705925.5Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files o CVE-2026-705936.6Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files