Microsoft CVE-2026-26174

This vulnerability (CWE-362) stems from a time-of-check-to-time-of-use (TOCTOU) flaw in Windows Server Update Service, a critical component that manages update distribution across Windows environments. WSUS handles privileged operations including package verification, registry modifications, and service control. The race condition occurs when multiple threads access shared resources without proper synchronization primitives (mutexes, semaphores, or atomic operations). An attacker with initial low-privilege access can manipulate the timing between resource checks and resource use, potentially injecting malicious operations during the vulnerable window. The vulnerability affects Windows 10 versions 1607 through 22H2, Windows 11 versions 22H3 through 26H1, and Windows Server from 2012 through 2025 (including Server Core installations), representing nearly the entire active Windows deployment base from build 6.2.9200.0 through 10.0.28000.x.