EUVD-2026-22515
GHSA-7phv-9jp9-84fq
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows SSDP Service (all Windows 10, 11, and Server versions from 2012 onwards) enables low-privileged authenticated users to gain SYSTEM-level access by exploiting a race condition in shared resource handling. The vulnerability requires low privileges and high attack complexity (CVSS AC:H), resulting in complete compromise of confidentiality, integrity, and availability. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all Windows 10, 11, and Server 2012+ systems in your environment and prioritize patch deployment for internet-facing and high-value assets. Within 7 days: Deploy vendor-released patches to all affected Windows versions using your established patch management process; confirm build numbers match vendor advisory. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today