What is the CVSS score of CVE-2026-58531?

CVE-2026-58531 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Windows Server 2012 are affected by CVE-2026-58531?

CVE-2026-58531 affects Windows 10, Windows 11, and Server editions (2012-2025), allowing authenticated attackers to escalate privileges and gain system-level access.. A patch is available.

How to fix or mitigate CVE-2026-58531?

Within 24 hours, inventory all Windows 10, Windows 11, and Windows Server (2012-2025) systems in your environment and identify systems exposed to network attacks or running critical business functions. Within 7 days, prioritize and begin staged deployment of the vendor-released patch starting with domain controllers, identity services, and business-critical systems that process sensitive data. Within 30 days, ensure patch deployment is complete across all affected systems organization-wide and verify compliance through your patch management tools.

Windows Server 2012 CVE-2026-58531

EUVD-2026-44292 HIGH

Race Condition (CWE-362)

2026-07-14 microsoft

GHSA-p7mm-537h-g9cx

Information Disclosure Race Condition Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:52 vuln.today

CVE Published

Jul 14, 2026 - 17:10 nvd

HIGH 7.5

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Elevation of privilege in the Windows SMB implementation allows an authenticated network attacker to win a race condition and gain higher privileges on affected systems, spanning Windows 10, Windows 11, and Windows Server 2012 through 2025. The flaw is a concurrency defect (CWE-362) reported by Microsoft with a vendor patch already released; there is no public exploit identified at time of analysis. Note a data conflict: the description and CVSS impacts describe privilege elevation with full confidentiality/integrity/availability impact, while the intelligence tags also label it 'Information Disclosure' — the CVSS vector should be treated as authoritative.