CVE-2026-83666
Awaiting Analysis
Awaiting Analysis - Queue
Race Condition in Active Directory Certificate Services Elevates Privileges
Vulnerability report for CVE-2026-83666, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-13
Last updated on: 2026-10-13
Assigner: Microsoft Corporation
Description
Description
Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Microsoft | Windows | 10 Version 1607 10.0.14393.0 |
| Microsoft | Windows | 10 Version 1809 10.0.17763.0 |
| Microsoft | Windows | Server 2012 6.2.9200.0 |
| Microsoft | Windows | Server 2012 (Server Core installation) 6.2.9200.0 |
| Microsoft | Windows | Server 2012 R2 6.3.9600.0 |
| Microsoft | Windows | Server 2012 R2 (Server Core installation) 6.3.9600.0 |
| Microsoft | Windows | Server 2016 10.0.14393.0 |
| Microsoft | Windows | Server 2016 (Server Core installation) 10.0.14393.0 |
| Microsoft | Windows | Server 2019 10.0.17763.0 |
| Microsoft | Windows | Server 2019 (Server Core installation) 10.0.17763.0 |
| Microsoft | Windows | Server 2022 10.0.20348.0 |
| Microsoft | Windows | Server 2025 10.0.26100.0 |
| Microsoft | Windows | Server 2025 (Server Core installation) 10.0.26100.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
