CVE-2026-70348
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Improper link resolution before file access ('link following') in Windows Management Services allows an authorized attacker to deny service locally.
Risk Assessment
The risk of local denial of service could lead to unavailability of the system or services for legitimate users.
Recommendation
It is recommended to apply security updates from the vendor and restrict access to Windows Management Services.
Other vulnerabilities in Windows Management Services
See all- CVE-2026-87691High
A use-after-free vulnerability in Windows Management Services allows an authorized attacker to elevate privileges locally.
- CVE-2026-73012High
Heap-based buffer overflow in Windows Management Services allows an authorized attacker to elevate privileges over a network.
- CVE-2026-58544High
Use-After-Free vulnerability in Windows Management Services. Allows an authorized attacker to elevate privileges locally.
- CVE-2026-20924High
A use-after-free vulnerability in Windows Management Services allows an authorized attacker to elevate privileges locally.
- CVE-2026-20923High
A use-after-free vulnerability in Windows Management Services allows an authorized attacker to elevate privileges locally.
- CVE-2026-20918High
A race condition exists in Windows Management Services due to improper synchronization of shared resources. This allows an authorized attacker to elevate privileges locally.
- CVE-2026-20877High
A use-after-free vulnerability exists in Windows Management Services. This allows an authorized attacker to elevate privileges locally.
- CVE-2026-20874High
A race condition exists in Windows Management Services due to improper synchronization of shared resources. This allows an authorized attacker to elevate privileges locally.
- CVE-2026-20873High
A race condition exists in Windows Management Services due to improper synchronization of shared resources. This allows an authorized attacker to elevate privileges locally.
- CVE-2026-20867High
A race condition exists in Windows Management Services due to improper synchronization of shared resources. This allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Improper link resolution before file access ('link following') in Windows Management Services allows an authorized attacker to deny service locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS