Windows Server 2012 CVE-2026-26174

Windows Server with WSUS (Windows Server Update Service) installed and running. Requires valid local user account credentials. Race condition window in WSUS shared resource handling must be exploitable through concurrent access patterns.

Real-world risk is moderate-to-high despite the 7.0 CVSS score. The attack vector is local (AV:L) requiring existing system access, but high attack complexity (AC:H) means exploitation demands sophisticated timing manipulation and likely multiple attempts to win the race condition. Low privileges required (PR:L) means any authenticated domain user or local account could attempt exploitation. The unchanged scope (S:U) limits impact to the vulnerable WSUS component, but complete compromise (C:H/I:H/A:H) grants SYSTEM-level control over update mechanisms. EPSS data not provided, but race conditions historically show lower exploitation rates due to technical difficulty. No CISA KEV listing indicates no confirmed active exploitation. However, the ubiquity of affected products (every Windows version since Server 2012) and the criticality of WSUS in enterprise environments elevate concern. Attackers with initial foothold could leverage this for domain escalation by compromising WSUS servers that distribute updates enterprise-wide. The high attack complexity serves as a natural barrier against opportunistic attacks but won't deter advanced persistent threat actors.

An authorized local user repeatedly sends concurrent requests to WSUS shared resources during update operations, exploiting unsynchronized access to escalate privileges to SYSTEM level before proper locking mechanisms engage.