What is the CVSS score of CVE-2026-24295?

CVE-2026-24295 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2026-24295?

CVE-2026-24295 is a local privilege escalation vulnerability in Windows Device Association Service that could allow authorized users to gain elevated system access.. A patch is available.

How to fix or mitigate CVE-2026-24295?

Within 24 hours: Inventory systems running affected Windows versions and assess exposure in high-value environments. Within 7 days: Implement access controls limiting Device Association Service usage to trusted administrators and disable the service where operationally feasible. Within 30 days: Establish monitoring for suspicious Device Association Service activity, prepare contingency patches through security baselines, and monitor vendor advisories for patch availability.

Windows CVE-2026-24295

HIGH

Race Condition (CWE-362)

2026-03-10 secure@microsoft.com

Windows Information Disclosure Race Condition Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2022 23h2 Windows Server 2025

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 7.0

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation in Windows Device Association Service across Windows 10, 11, and Server 2022 stems from improper synchronization of shared resources, enabling local authenticated users to gain elevated system privileges. The vulnerability requires local access and specific timing conditions but poses high risk due to its impact on confidentiality, integrity, and availability. No patch is currently available.

Technical ContextAI

Classified as CWE-362 (Race Condition). Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.