What is the CVSS score of CVE-2026-59126?

CVE-2026-59126 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows Event Logging are affected by CVE-2026-59126?

Thousands of Windows desktops and servers across your infrastructure are vulnerable to local privilege escalation through the Event Logging Service, enabling any user with system access to gain…. A patch is available.

How to fix or mitigate CVE-2026-59126?

Within 24 hours, initiate an inventory of all Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 systems to establish baseline exposure across the enterprise. Within 7 days, deploy the vendor-released patch for CVE-2026-59126 to non-production systems (development, testing, staging environments) and validate that event logging functionality and all dependent security monitoring tools remain operational. Within 30 days, complete full production deployment across all affected Windows endpoints and servers, prioritizing mission-critical systems and servers first, and confirm successful patch installation through patch management dashboards and audit log verification.

Windows Event Logging CVE-2026-59126

EUVD-2026-56611 HIGH

Race Condition (CWE-362)

2026-08-11 secure@microsoft.com

GHSA-c36p-x6jj-7x9r

Information Disclosure Race Condition Microsoft Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2022 Windows Server 2025

7.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local access and a valid low-privileged account are required; AC:H reflects the inherent timing uncertainty of race condition exploitation; full CIA impact is consistent with SYSTEM-level privilege gain on the vulnerable host.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:11 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 cve.org

HIGH 7.0

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation in the Windows Event Logging Service affects Windows 10, Windows 11, and Windows Server 2022/2025 across a wide range of builds via an improperly synchronized race condition on a shared resource. An authorized local attacker with low-level credentials can win a concurrent execution timing window to gain full SYSTEM-level privileges, achieving complete confidentiality, integrity, and availability compromise on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions across both client and server editions makes patching a high-priority operational item.

Technical ContextAI

CWE-362 identifies this as 'Concurrent Execution Using Shared Resource with Improper Synchronization' - a race condition where two or more threads access a shared resource without adequate locking. The Windows Event Logging Service (EventLog) is a core Windows OS component running at elevated privilege, responsible for receiving, indexing, and querying Windows event log data from across the system. A flaw in the service's concurrent access handling exposes a timing window where a low-privileged caller can interfere with the service's internal state - potentially redirecting execution or corrupting shared structures - leading to privilege escalation. Affected builds span Windows 10 21H2 (10.0.19044.x), Windows 10 22H2 (10.0.19045.x), Windows 11 23H2 through 26H1 (10.0.22631.x through 10.0.28000.x), Windows Server 2022 (10.0.20348.x), and Windows Server 2025 including Server Core (10.0.26100.x), all sharing the same EventLog service implementation lineage. The 'Information Disclosure' tag in the intelligence data suggests the race condition may also leak sensitive log data during exploitation attempts, adding a secondary impact vector beyond the primary LPE.

RemediationAI

Apply Microsoft's security update to advance system builds beyond the fixed thresholds: Windows 10 21H2 to build 10.0.19044.7663 or later, Windows 10 22H2 to 10.0.19045.7663 or later, Windows 11 23H2 to 10.0.22631.7517 or later, Windows 11 24H2 and Windows Server 2025 (including Server Core) to 10.0.26100.9168 or 10.0.26100.33296 respectively, Windows 11 25H2 to 10.0.26200.9168 or later, Windows 11 26H1 to 10.0.28000.2704 or later, and Windows Server 2022 to 10.0.20348.5499 or later. Consult the full MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59126 for specific KB article numbers and update packages. As a compensating control where immediate patching is not possible, restrict interactive local logon rights to only necessary administrative accounts via Group Policy (User Rights Assignment: 'Allow log on locally'), reducing the pool of potential attackers to those already holding elevated access. Disabling the EventLog service itself is not a viable workaround as it breaks security auditing, event-based alerting, and numerous dependent Windows components.