CVE-2026-20830 — Race Condition in Microsoft Windows Server 2025

CWE-362 — Race ConditionCWE-416 — Use After Free8 documents7 sources
Severity
7.0HIGHNVD
EPSS
0.0%
top 93.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft Windows Server 2025
Timeline
PublishedJan 13

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages2 packages

▶NVDmicrosoft/windows< 10.0.26100.7623
▶CVEListV5microsoft/windows_server_202510.0.26100.0 — 10.0.26100.32230

🔴Vulnerability Details

2
GHSA
GHSA-5q9m-xqg4-7xqr: Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an↗2026-01-13
▶
CVEList
Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability↗2026-01-13
▶

📋Vendor Advisories

1
Microsoft
Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability↗2026-01-13
▶

🕵️Threat Intelligence

4
Qualys
Microsoft and Adobe Patch Tuesday, January 2026 Security Update Review↗2026-01-13
▶
Bleepingcomputer
Microsoft January 2026 Patch Tuesday fixes 3 zero-days, 114 flaws↗2026-01-13
▶
Qualys
Microsoft and Adobe Patch Tuesday, January 2026 Security Update Review | Qualys↗2026-01-13
▶
Wiz
CVE-2026-20830 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-20830 — Race Condition in Microsoft | cvebase