Race Condition in Windows SMB Server Enables Privilege Escalation

Publication date: 2026-01-13

Last updated on: 2026-05-26

Assigner: Microsoft Corporation

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-13

Last Modified

2026-05-26

Generated

2026-07-06

AI Q&A

2026-01-14

EPSS Evaluated

2026-07-05

NVD

CVE-2026-20921

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_smb_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition in the Windows SMB Server where concurrent execution using a shared resource occurs without proper synchronization. This flaw allows an authorized attacker to elevate their privileges over a network. [1]

Impact Analysis

An attacker who is authorized on the network can exploit this vulnerability to elevate their privileges, potentially gaining higher-level access than intended, which can lead to unauthorized actions and compromise of the system. [1]

Hi! I’m here to help you understand CVE-2026-20921. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70