CVE-2026-20930

published 2026-04-14

CVE-2026-20930: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to…

high 7.8 CVSS 3.1

AV L AC H PR L UI N S C C H I H A H

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

Affected

20 ranges

Vendor	Product	Version range	Fixed in
microsoft	windows_10_1809	< 10.0.17763.8644	10.0.17763.8644
microsoft	windows_10_21h2	< 10.0.19044.7184	10.0.19044.7184
microsoft	windows_10_22h2	< 10.0.19045.7184	10.0.19045.7184
microsoft	windows_10_version_1809	>= 10.0.17763.0 < 10.0.17763.8644	10.0.17763.8644
microsoft	windows_10_version_21h2	>= 10.0.19044.0 < 10.0.19044.7184	10.0.19044.7184
microsoft	windows_10_version_22h2	>= 10.0.19045.0 < 10.0.19045.7184	10.0.19045.7184
microsoft	windows_11_23h2	< 10.0.22631.6936	10.0.22631.6936
microsoft	windows_11_24h2	< 10.0.26100.8246	10.0.26100.8246
microsoft	windows_11_25h2	< 10.0.26200.8246	10.0.26200.8246
microsoft	windows_11_version_22h3	>= 10.0.22631.0 < 10.0.22631.6936	10.0.22631.6936
microsoft	windows_11_version_23h2	>= 10.0.22631.0 < 10.0.22631.6936	10.0.22631.6936
microsoft	windows_11_version_24h2	>= 10.0.26100.0 < 10.0.26100.8246	10.0.26100.8246
microsoft	windows_11_version_25h2	>= 10.0.26200.0 < 10.0.26200.8246	10.0.26200.8246
microsoft	windows_server_2019	< 10.0.17763.8644	10.0.17763.8644
microsoft	windows_server_2019	>= 10.0.17763.0 < 10.0.17763.8644	10.0.17763.8644
microsoft	windows_server_2022	< 10.0.20348.5020	10.0.20348.5020
microsoft	windows_server_2022	>= 10.0.20348.0 < 10.0.20348.5020	10.0.20348.5020
microsoft	windows_server_2022_23h2	< 10.0.25398.2274	10.0.25398.2274
microsoft	windows_server_2025	< 10.0.26100.32690	10.0.26100.32690
microsoft	windows_server_2025	>= 10.0.26100.0 < 10.0.26100.32690	10.0.26100.32690

CWE-362