CVE-2026-96215
HighCVSS 7.0Summary
A race condition vulnerability in Windows Autopilot arises from improper synchronization when accessing a shared resource. An authenticated attacker can exploit this flaw to elevate privileges locally.
Risk Assessment
An attacker with valid credentials could elevate their privileges on the system, potentially leading to full device compromise and access to other users' data.
Recommendation
Immediately install the latest Microsoft security updates for Windows that address this vulnerability.
Other vulnerabilities in Windows Autopilot
See all- CVE-2026-73004Medium
Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally.
- CVE-2026-65783High
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
- CVE-2026-65782High
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
- CVE-2026-65781High
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
- CVE-2026-65780High
Double free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
- CVE-2026-65779High
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
- CVE-2026-65778High
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS