CVE-2026-20866
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A race condition exists in Windows Management Services due to improper synchronization of shared resources. This allows an authorized attacker to elevate privileges locally.
Risk Assessment
An authorized user can escalate privileges, potentially gaining control over sensitive system resources.
Recommendation
Apply the security update from Microsoft for Windows Management Services.
Other vulnerabilities in Windows Management Services
See all- CVE-2026-70348Medium
Improper link resolution before file access ('link following') in Windows Management Services allows an authorized attacker to deny service locally.
- CVE-2026-58544High
Use-After-Free vulnerability in Windows Management Services. Allows an authorized attacker to elevate privileges locally.
- CVE-2026-20924High
A use-after-free vulnerability in Windows Management Services allows an authorized attacker to elevate privileges locally.
- CVE-2026-20923High
A use-after-free vulnerability in Windows Management Services allows an authorized attacker to elevate privileges locally.
- CVE-2026-20918High
A race condition exists in Windows Management Services due to improper synchronization of shared resources. This allows an authorized attacker to elevate privileges locally.
- CVE-2026-20877High
A use-after-free vulnerability exists in Windows Management Services. This allows an authorized attacker to elevate privileges locally.
- CVE-2026-20874High
A race condition exists in Windows Management Services due to improper synchronization of shared resources. This allows an authorized attacker to elevate privileges locally.
- CVE-2026-20873High
A race condition exists in Windows Management Services due to improper synchronization of shared resources. This allows an authorized attacker to elevate privileges locally.
- CVE-2026-20867High
A race condition exists in Windows Management Services due to improper synchronization of shared resources. This allows an authorized attacker to elevate privileges locally.
- CVE-2026-20865High
A use-after-free vulnerability in Windows Management Services allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.