EUVD-2026-45061
GHSA-v83q-c28h-3q53
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 16, 2026
Local privilege escalation in the Windows Backup Engine affects Windows 10 (21H2, 22H2) and Windows 11 (24H2, 25H2, 26H1), where a race condition (CWE-362) lets an already-authenticated low-privileged user win a timing window to elevate to higher privileges. The CVSS 3.1 base score is 7.0 (AV:L/AC:H/PR:L), reflecting local access and high attack complexity but full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; a vendor patch is available from Microsoft.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Windows 10 Version 21H2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft) · only source for this CVE.
CVSS VectorVendor: microsoft
DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A privilege escalation vulnerability in the Windows Backup Engine affects Windows 10 and Windows 11 systems, allowing authenticated standard users to elevate to higher privilege levels. This undermines least-privilege security controls and could enable insider threats to gain administrative access across the enterprise.
Within 24 hours, identify and inventory all Windows 10 (21H2, 22H2) and Windows 11 (24H2, 25H2, 26H1) systems using the Windows Backup Engine and prioritize systems with high numbers of standard-privilege users. Within 7 days, deploy the available Microsoft patch through your patch management system to all affected devices. Within 30 days, verify deployment completion across your environment, validate backup functionality has not been impacted, and document the remediation for audit purposes.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
More in Windows 10 Version 21H2
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Microsoft Install Service (Windows Installer) affects supported Windows 10, Windows 11
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Exploit-DB