What is the CVSS score of CVE-2026-24296?

CVE-2026-24296 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows Server 2022 23h2 are affected by CVE-2026-24296?

A race condition vulnerability in Windows Device Association Service could allow authorized users to gain elevated system privileges on affected devices.. A patch is available.

How to fix or mitigate CVE-2026-24296?

Within 24 hours: Inventory all systems running affected Windows versions and restrict device association service access to trusted administrators only. Within 7 days: Implement enhanced monitoring and logging for Device Association Service process execution and privilege escalation attempts. Within 30 days: Deploy application whitelisting and enforce principle of least privilege for user accounts; establish vendor patch availability tracking for this CVE.

Windows Server 2022 23h2 CVE-2026-24296

HIGH

Race Condition (CWE-362)

2026-03-10 secure@microsoft.com

Race Condition Microsoft Information Disclosure Windows Server 2022 23h2 Windows Server 2019 Windows 11 23h2 Windows 10 1607 Windows Server 2016 Windows 11 25h2 Windows Server 2012 Windows Server 2022 Windows 10 21h2 Windows 11 24h2 Windows 10 22h2 Windows 10 1809 Windows Server 2025 Windows 11 26h1 Windows

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 7.0

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation in Windows Device Association Service (Windows 10 versions 1607, 1809, and 21H2) stems from improper synchronization of shared resources, enabling local authenticated users to gain elevated system privileges. The vulnerability requires high attack complexity and no user interaction, making it exploitable by insiders or compromised local accounts. No patch is currently available.

Technical ContextAI

Classified as CWE-362 (Race Condition). Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.