What is the CVSS score of CVE-2026-58531?

CVE-2026-58531 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Windows Server 2012 CVE-2026-58531

Q: Which versions of Windows Server 2012 are affected by CVE-2026-58531?

CVE-2026-58531 affects Windows 10, Windows 11, and Server editions (2012-2025), allowing authenticated attackers to escalate privileges and gain system-level access.. A patch is available.

Q: How to fix or mitigate CVE-2026-58531?

Within 24 hours, inventory all Windows 10, Windows 11, and Windows Server (2012-2025) systems in your environment and identify systems exposed to network attacks or running critical business functions. Within 7 days, prioritize and begin staged deployment of the vendor-released patch starting with domain controllers, identity services, and business-critical systems that process sensitive data. Within 30 days, ensure patch deployment is complete across all affected systems organization-wide and verify compliance through your patch management tools.

EUVD-2026-44292 HIGH

Race Condition (CWE-362)

2026-07-14 microsoft

GHSA-p7mm-537h-g9cx

Information Disclosure Race Condition Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.5

CVSS 3.1 · Vendor: microsoft

View

Vulnerability Assessment

Weakness

CWE

CWE-362

OWASP Top 10:2025

A06:2025 - Insecure Design

ASVS 5.0

V15 - Secure Coding and Architecture Concurrency control, locking

MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Elevation of privilege in the Windows SMB implementation allows an authenticated network attacker to win a race condition and gain higher privileges on affected systems, spanning Windows 10, Windows 11, and Windows Server 2012 through 2025. The flaw is a concurrency defect (CWE-362) reported by Microsoft with a vendor patch already released; there is no public exploit identified at time of analysis. Note a data conflict: the description and CVSS impacts describe privilege elevation with full confidentiality/integrity/availability impact, while the intelligence tags also label it 'Information Disclosure' — the CVSS vector should be treated as authoritative.

Affected VersionsENISA

Windows Server 2012 R2 6.3.9600.0 <6.3.9600.23291

Windows 11 Version 24H2 10.0.26100.0 <10.0.26100.8875

Windows 11 version 26H1 10.0.28000.0 <10.0.28000.2525

Windows 10 Version 21H2 10.0.19044.0 <10.0.19044.7548

Windows Server 2012 R2 (Server Core installation) 6.3.9600.0 <6.3.9600.23291

Windows Server 2025 10.0.26100.0 <10.0.26100.33158

Windows Server 2012 6.2.9200.0 <6.2.9200.26226

Windows Server 2016 10.0.14393.0 <10.0.14393.9339

Windows Server 2022 10.0.20348.0 <10.0.20348.5386

Windows Server 2016 (Server Core installation) 10.0.14393.0 <10.0.14393.9339

Windows Server 2019 10.0.17763.0 <10.0.17763.9020

Windows 11 Version 25H2 10.0.26200.0 <10.0.26100.8875

Windows 10 Version 22H2 10.0.19045.0 <10.0.19045.7548

Windows Server 2012 (Server Core installation) 6.2.9200.0 <6.2.9200.26226

Windows 10 Version 1809 10.0.17763.0 <10.0.17763.9020

Windows 10 Version 1607 10.0.14393.0 <10.0.14393.9339

Windows Server 2025 (Server Core installation) 10.0.26100.0 <10.0.26100.33158

Windows Server 2019 (Server Core installation) 10.0.17763.0 <10.0.17763.9020

Affected Packages

euvd windows_10_version_1607 fix: 10.0.14393.9339

euvd windows_10_version_1809 fix: 10.0.17763.9020

euvd windows_10_version_21h2 fix: 10.0.19044.7548

euvd windows_10_version_22h2 fix: 10.0.19045.7548

euvd windows_11_version_24h2 fix: 10.0.26100.8875

euvd windows_11_version_25h2 fix: 10.0.26100.8875

euvd windows_11_version_26h1 fix: 10.0.28000.2525

euvd windows_server_2012 fix: 6.2.9200.26226

euvd windows_server_2012_r2 fix: 6.3.9600.23291

euvd windows_server_2012_r2_server_core_installation fix: 6.3.9600.23291

euvd windows_server_2012_server_core_installation fix: 6.2.9200.26226

euvd windows_server_2016 fix: 10.0.14393.9339

euvd windows_server_2016_server_core_installation fix: 10.0.14393.9339

euvd windows_server_2019 fix: 10.0.17763.9020

euvd windows_server_2019_server_core_installation fix: 10.0.17763.9020

euvd windows_server_2022 fix: 10.0.20348.5386

euvd windows_server_2025 fix: 10.0.26100.33158

euvd windows_server_2025_server_core_installation fix: 10.0.26100.33158

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 18 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Windows Server 2012 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an authorized attacker to elevate privileges over a network.

Executive ViewAI

Why It Matters

CVE-2026-58531 affects Windows 10, Windows 11, and Server editions (2012-2025), allowing authenticated attackers to escalate privileges and gain system-level access. Successful exploitation could enable unauthorized data access, system compromise, and operational disruption across your Windows infrastructure. Microsoft has released a patch for immediate deployment.

Recommended Action

Within 24 hours, inventory all Windows 10, Windows 11, and Windows Server (2012-2025) systems in your environment and identify systems exposed to network attacks or running critical business functions. Within 7 days, prioritize and begin staged deployment of the vendor-released patch starting with domain controllers, identity services, and business-critical systems that process sensitive data. Within 30 days, ensure patch deployment is complete across all affected systems organization-wide and verify compliance through your patch management tools.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.5%

Top 60% exploitable

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation More Likely

Data Quality

5 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).