Skip to main content
View

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

Can lead to privilege escalation, data corruption, or bypassing of security checks depending on the context of the race. With a CVSS score of 7.4 (HIGH), this represents a significant risk.
Exploit ScenarioDerived

An attacker exploits a time-of-check-time-of-use (TOCTOU) window to modify a resource between when it's validated and when it's used.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an unauthorized attacker to elevate privileges locally.

Earlier versions of this analysis (1)
v1 Mar 16, 2026 - 04:21 CVSS 7.4

RemediationAI

Use proper synchronization mechanisms (locks, mutexes, atomic operations). Implement file locking for filesystem operations. Avoid TOCTOU patterns.

Affected VersionsENISA

Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.0 <10.0.25398.1732
Windows 11 version 22H2 10.0.22621.0 <10.0.22621.5624
Windows Server 2025 10.0.26100.0 <10.0.26100.4652
Windows 11 Version 23H2 10.0.22631.0 <10.0.22631.5624
Windows Server 2019 10.0.17763.0 <10.0.17763.7558
Windows 10 Version 21H2 10.0.19044.0 <10.0.19044.6093
Windows Server 2019 (Server Core installation) 10.0.17763.0 <10.0.17763.7558
Windows 11 version 22H3 10.0.22631.0 <10.0.22631.5624
Windows 10 Version 1809 10.0.17763.0 <10.0.17763.7558
Windows Server 2025 (Server Core installation) 10.0.26100.0 <10.0.26100.4652
Windows 10 Version 22H2 10.0.19045.0 <10.0.19045.6093
Windows Server 2022 10.0.20348.0 <10.0.20348.3932
Windows 11 Version 24H2 10.0.26100.0 <10.0.26100.4652

Affected Packages

euvd windows_10_version_1809 fix: 10.0.17763.7558
euvd windows_10_version_21h2 fix: 10.0.19044.6093
euvd windows_10_version_22h2 fix: 10.0.19045.6093
euvd windows_11_version_22h2 fix: 10.0.22621.5624
euvd windows_11_version_22h3 fix: 10.0.22631.5624
euvd windows_11_version_23h2 fix: 10.0.22631.5624
euvd windows_11_version_24h2 fix: 10.0.26100.4652
euvd windows_server_2019 fix: 10.0.17763.7558
euvd windows_server_2019_server_core_installation fix: 10.0.17763.7558
euvd windows_server_2022 fix: 10.0.20348.3932
euvd windows_server_2022_23h2_edition_server_core_installation fix: 10.0.25398.1732
euvd windows_server_2025 fix: 10.0.26100.4652
euvd windows_server_2025_server_core_installation fix: 10.0.26100.4652

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 13 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

A race condition occurs when the behavior of software depends on the timing of events, such as the order of execution of threads or processes.

Know when Windows 10 1809 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.4 HIGH
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Updated
Apr 16, 2026 - 06:30 EUVD-patch-fix
executive summary
Patch available
Apr 16, 2026 - 05:29 EUVD
10.0.25398.1732,10.0.22621.5624,10.0.26100.4652
CVE Published
Jul 08, 2025 - 17:15 nvd
HIGH 7.4

Executive ViewAI

Why It Matters

CVE-2025-49690 is a local privilege escalation vulnerability in Windows Capability Access Management Service (camsvc) exploitable through a race condition, enabling unauthorized attackers with local system access to gain elevated privileges. This directly impacts any Windows user with local logon capabilities and could enable lateral movement, persistence, or full system compromise if exploited post-breach.

Business Impact: High
Compensating Controls

Apply vendor patch. Until patching is complete: restrict local logon access through Group Policy (disable local administrator accounts where feasible), monitor and alert on camsvc service anomalies or repeated privilege escalation attempts, and limit user elevation through UAC enforcement.

Threat Intelligence Overview

EPSS Score
0.0%
Top 88% exploitable
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

37
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +37
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

More in Windows 10 1809

View all
CVE-2021-40444 HIGH POC
8.8 Sep 15

Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
CVE-2021-34527 HIGH POC
8.8 Jul 02

<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
CVE-2022-30190 HIGH POC
7.8 Jun 01

Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
CVE-2021-1732 HIGH POC
7.8 Feb 25

Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
CVE-2021-1675 HIGH POC
7.8 Jun 08

Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
CVE-2021-36934 HIGH POC
7.8 Jul 22

Windows contains an elevation of privilege vulnerability known as 'HiveNightmare' or 'SeriousSAM' where overly permissiv
CVE-2023-36884 HIGH POC
7.5 Jul 11

Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
CVE-2024-21412 HIGH POC
8.1 Feb 13

Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2024-30088 HIGH POC
7.0 Jun 11

Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
CVE-2018-8453 HIGH POC
7.8 Oct 10

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

CVE-2025-33053 HIGH POC
8.8 Jun 10

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables

Same weakness CWE-362 – Race Condition

View all
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2025-39964 MEDIUM POC
5.5

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

References

Advisories & patches
ADVISORY https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49690 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-49690

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy