CVE-2026-83666
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.
Risk Assessment
An authorized user can exploit the race condition to gain elevated privileges, potentially leading to system integrity compromise.
Recommendation
Install Windows security updates that address this issue.
Other vulnerabilities in Active Directory Certificate Services
See all- CVE-2026-69624Medium
An incomplete list of disallowed inputs in Active Directory Certificate Services (AD CS) allows an authorized attacker to perform tampering over a network.
- CVE-2026-69395Medium
The vulnerability in Active Directory Certificate Services (AD CS) involves the use of an externally-controlled format string. This allows an authorized attacker to disclose information over a network.
- CVE-2026-62810High
Heap-based buffer overflow in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.
- CVE-2026-62818High
Use after free in Active Directory Certificate Services (AD CS) allows an authorized attacker to execute code over a network.
- CVE-2026-54121High
An improper authorization vulnerability in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
Original NVD description (English source)
Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS