CVE-2026-20848
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A race condition vulnerability in Windows SMB Server allows an authorized attacker to elevate privileges over a network. The issue stems from improper synchronization when accessing shared resources concurrently.
Risk Assessment
An authorized user can escalate privileges, potentially leading to system compromise or access to sensitive data.
Recommendation
Install the latest security updates from Microsoft for Windows SMB Server. Monitor and restrict access to SMB services.
Other vulnerabilities in Windows SMB Server
See all- CVE-2026-26128High
Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.
- CVE-2026-62800High
Heap-based buffer overflow in Windows SMB Server allows an authorized attacker to execute code over a network.
- CVE-2026-62790High
Heap-based buffer overflow in Windows SMB Server allows an authorized attacker to execute code over a network.
- CVE-2026-57089High
Use-after-free vulnerability in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to execute code over a network.
- CVE-2026-56168Medium
A null pointer dereference in Windows SMB Server allows an authorized attacker to cause a denial of service over the network.
- CVE-2026-50360High
Incorrect implementation of the authentication algorithm in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-24294High
A vulnerability in Windows SMB Server due to improper authentication allows local privilege escalation. An authorized attacker can exploit this flaw to gain higher privileges on the system.
- CVE-2026-20934High
A race condition vulnerability in Windows SMB Server allows an authorized attacker to elevate privileges over a network. The issue stems from improper synchronization when accessing shared resources concurrently.
- CVE-2026-20927Medium
A race condition in Windows SMB Server allows an authenticated attacker to cause a denial of service over the network.
- CVE-2026-20926High
A race condition vulnerability in Windows SMB Server allows an authorized attacker to elevate privileges over a network. The issue stems from improper synchronization when accessing shared resources concurrently.
Original NVD description (English source)
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.