EUVD-2026-73083
GHSA-rcwm-9mcw-m52x
Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Consistent with vendor vector: local-only attack surface, race condition requires AC:H, high privileges prerequisite per WMI access model, full impact if race is won.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation in Windows Management Instrumentation (WMI) on Windows 10, Windows 11, and Windows Server 2012 through 2025 allows a locally authenticated attacker with high-privilege access to gain further elevated system permissions by exploiting a race condition in concurrent shared-resource handling. The flaw spans a broad Windows version range-from the legacy Server 2012 family through Windows 11 26H1 and Server 2025-indicating a long-standing WMI component is affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local interactive access or an established remote session (AV:L) on the target Windows system; (2) high-privilege credentials (PR:H per CVSS) already held on that system-such as a local administrator or a highly privileged service account; (3) the ability to execute concurrent WMI API calls in a race window, which the CVSS AC:H metric rates as high complexity due to timing sensitivity. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.4 score reflects meaningfully constrained real-world risk: AV:L limits exploitation entirely to the local host, AC:H reflects the non-trivial challenge of reliably winning a race condition without specialized tooling, and PR:H requires the attacker to already hold elevated local credentials before the race can even be attempted. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update for CVE-2026-70582 distributed via Windows Update, WSUS, or Microsoft Update Catalog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today