CVE-2026-83697

Analyzed Analyzed - Analysis Complete

Time-of-Check Time-of-Use Race Condition in Windows MDM

Publication date: 2026-10-13

Last updated on: 2026-10-30

Assigner: Microsoft Corporation

Description

Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-30

Generated

2026-11-08

AI Q&A

2026-10-14

EPSS Evaluated

2026-11-07

NVD

CVE-2026-83697

EUVD

EUVD-2026-99955

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_10_1809	to 10.0.17763.9376 (exc)
microsoft	windows_10_1809	to 10.0.17763.9376 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7807 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7807 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7807 (exc)
microsoft	windows_11_23h2	to 10.0.22631.7652 (exc)
microsoft	windows_11_23h2	to 10.0.22631.7652 (exc)
microsoft	windows_11_24h2	to 10.0.26100.9711 (exc)
microsoft	windows_11_24h2	to 10.0.26100.9711 (exc)
microsoft	windows_11_25h2	to 10.0.26200.9711 (exc)
microsoft	windows_11_25h2	to 10.0.26200.9711 (exc)
microsoft	windows_11_26h1	to 10.0.28000.3231 (exc)
microsoft	windows_11_26h1	to 10.0.28000.3231 (exc)
microsoft	windows_11_26h2	to 10.0.26300.9711 (exc)
microsoft	windows_11_26h2	to 10.0.26300.9711 (exc)
microsoft	windows_server_2019	to 10.0.17763.9376 (exc)
microsoft	windows_server_2025	to 10.0.26100.33650 (exc)
microsoft	windows_server_2022	to 10.0.20348.5761 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7807 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7807 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7807 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This is a time-of-check time-of-use (TOCTOU) race condition in Windows Modern Device Management (MDM). It allows an authorized attacker to tamper with system configurations or settings locally by exploiting timing inconsistencies between checking and using a resource.

Detection Guidance

This vulnerability involves a race condition in Windows MDM. Detection requires monitoring for unauthorized tampering attempts during MDM operations. Check Windows Event Logs for MDM-related errors or anomalies in System and Security logs. Use PowerShell commands like Get-WinEvent -LogName System -MaxEvents 100 to review recent events. Look for repeated access attempts to MDM configuration files or registry keys.

Impact Analysis

An attacker with local access could modify MDM configurations or settings, potentially bypassing security controls, installing unauthorized software, or altering system behavior without proper authorization.

Compliance Impact

This vulnerability allows local tampering via a race condition in Windows MDM, which could lead to unauthorized changes in device management policies. Such tampering may violate compliance requirements for data protection and integrity in standards like GDPR and HIPAA, as unauthorized modifications could compromise security controls or data handling practices.

Mitigation Strategies

Apply the latest security updates from Microsoft to patch the Windows MDM TOCTOU vulnerability. Monitor Microsoft's update guide for patches and install them promptly.

Hi! I’m here to help you understand CVE-2026-83697. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...