What is the CVSS score of CVE-2026-20826?

CVE-2026-20826 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Microsoft Windows are affected by CVE-2026-20826?

This vulnerability in the Windows TWINUI subsystem creates an insider threat vector: any user with a local account can escalate to administrative (SYSTEM) privileges through a timing exploit,…. A patch is available.

How to fix or mitigate CVE-2026-20826?

Within 24 hours, inventory all Windows 10 (1607-25H2), Windows 11, and Windows Server 2016-2025 systems across production and development environments to identify scope and asset criticality. Within 7 days, prioritize critical and high-value systems; deploy the latest Microsoft security updates for the TWINUI subsystem after validation in non-production staging environments. Within 30 days, complete patch deployment across all identified in-scope systems, verify installation through device management tools or log analysis, and formally document patch compliance.

Microsoft Windows CVE-2026-20826

HIGH

Race Condition (CWE-362)

2026-01-13 secure@microsoft.com

Information Disclosure Race Condition Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2022 23h2 Windows Server 2025

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local-only escalation needing prior low-privilege access (AV:L/PR:L); timing-dependent race sets AC:H; success yields SYSTEM control, so C/I/A all High.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 30, 2026 - 21:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 21:37 vuln.today

cvss_changed

CVSS changed

Jul 30, 2026 - 21:37 NVD

7.8 (HIGH) 7.0 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 13, 2026 - 18:16 nvd

HIGH 7.8

DescriptionNVD

Concurrent execution using shared resource with improper synchronization ('race condition') in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Tablet Windows User Interface (TWINUI) subsystem of Microsoft Windows lets an already-authenticated low-privileged user win a race condition (CWE-362) to gain higher privileges. The flaw spans a broad range of client and server builds (Windows 10 1607 through Windows 11 25H2, Windows Server 2016 through 2025) and, per its high-integrity/high-confidentiality/high-availability impact, can yield full SYSTEM-level control on a compromised host. No public exploit identified at time of analysis, and EPSS rates near-term mass exploitation as very low (0.03%).

Technical ContextAI

TWINUI is the Windows shell component that backs the tablet/touch and modern UI presentation layer, running as part of the interactive session's UI stack. The root cause is CWE-362, a concurrent-execution race condition arising from improper synchronization of a shared resource: when two threads access shared state without correct locking, an attacker who reliably interleaves operations (a TOCTOU-style window) can manipulate object state to execute code or access data at a higher privilege boundary. The CPE data confirms the defect lives in the OS itself (cpe:2.3:o:microsoft:windows_*) across both x86 and x64 client editions (Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2) and server editions (Windows Server 2016/2019/2022/2022 23H2/2025), indicating shared TWINUI code across the supported Windows codebase rather than an edition-specific regression.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update for your specific Windows edition and build as published on the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20826); the exact fixed KB/build number is not enumerated in the provided data and must be taken from that advisory for each affected release. Because this is a local privilege-escalation requiring prior low-privilege access, the most effective compensating controls until patching is complete are to reduce the number of untrusted local sessions on affected hosts: enforce least privilege and remove unnecessary interactive/RDP logon rights for standard users on servers, restrict who can run arbitrary code on tablet/touch-enabled and Terminal Server hosts, and monitor for anomalous local process behavior. Note the trade-off - none of these controls fixes the race condition itself; they only shrink the population of users who could attempt it, so patching remains the only complete remediation.