What is the CVSS score of CVE-2026-20816?

CVE-2026-20816 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows Installer are affected by CVE-2026-20816?

Microsoft Windows Installer vulnerability (CVE-2026-20816) creates a significant privilege escalation risk that could allow standard users with local access to assume administrative control of…. A patch is available.

How to fix or mitigate CVE-2026-20816?

Within 24 hours, conduct a complete inventory of Windows client and server systems in your environment and immediately deploy patches to internet-facing or business-critical systems. Within 7 days, complete patch deployment across all production Windows infrastructure including domain controllers, file servers, and systems with multiple user accounts. By 30 days, verify 100% patch coverage through automated compliance scanning and resolve any systems that remain unpatched.

Windows Installer CVE-2026-20816

HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-01-13 secure@microsoft.com

Information Disclosure Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows Server 2008 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2022 23h2 Windows Server 2025

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local low-privileged attacker (AV:L/PR:L) must win a timing race (AC:H) with no user interaction, yielding full SYSTEM-level compromise (C:H/I:H/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 30, 2026 - 21:45 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 21:37 vuln.today

cvss_changed

CVSS changed

Jul 30, 2026 - 21:37 NVD

7.8 (HIGH) 7.0 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 13, 2026 - 18:16 nvd

HIGH 7.8

DescriptionNVD

Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Windows Installer (msiexec/Windows Installer service) allows an authenticated low-privileged user to win a time-of-check-to-time-of-use (TOCTOU) race and gain SYSTEM-level privileges across supported Windows client and server releases. Exploitation requires local access and winning a narrow timing window, and there is no public exploit identified at time of analysis. EPSS is very low (0.03%, 6th percentile), reflecting the high attack complexity and lack of observed exploitation.

Technical ContextAI

Windows Installer is the core MSI-based software installation and servicing engine present on all supported Windows versions; it runs privileged operations (as SYSTEM) on behalf of unprivileged callers during install, repair, and rollback actions. The root cause is CWE-367 (TOCTOU race condition): the service validates a resource - such as a file path, symlink target, or object handle - at one moment and then acts on it at a later moment, during which an attacker with concurrent local access can swap the resource. Per the affected CPE set, this spans the Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server (2008 SP2 through 2025) code lines, indicating the flawed code path is in the shared Windows Installer component rather than an edition-specific feature.

RemediationAI

Apply the Microsoft security update for CVE-2026-20816 (Patch available per vendor advisory); the exact KB and fixed build for each Windows edition are listed in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20816 - install the corresponding monthly cumulative update for your OS version. No exact fixed version string is provided in the input data, so pull the specific build from that advisory rather than assuming a number. As interim compensating controls where patching must be delayed, limit local interactive and RDP logon rights so only trusted administrators have local access (removing the low-privileged foothold this exploit requires), which has the trade-off of restricting legitimate multi-user scenarios; and monitor for anomalous msiexec/Windows Installer activity and rapid file/symlink manipulation in installer working directories, accepting that detection is best-effort and does not close the race window. Because the vulnerable component is core to software installation, disabling Windows Installer outright is not a practical workaround.