EUVD-2026-99470
GHSA-5rx7-h3v9-5rhf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local session
-
DeliveryTrigger Performance Monitor code path
-
ExploitWin race on shared resource
-
ExecutionExecute code as SYSTEM
-
ImpactFull local privilege escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an attacker who already holds a valid low-privileged local account on the Windows host (PR:L) and the ability to repeatedly invoke the Windows Performance Monitor component to exploit improper synchronization of a shared resource (CWE-362). No user interaction is needed (UI:N). Exploitation is LIMITED by high attack complexity (AC:H): success depends on winning a non-deterministic timing window, so attempts are probabilistic and may fail repeatedly, and the vector is local-only (AV:L) - there is no remote or unauthenticated path. These factors, plus CISA Automatable=no, make reliable weaponization difficult despite the total technical impact. |
| Impact | This is a genuine but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) requires local access, already-held low privileges, and winning a timing-sensitive race (AC:H), while delivering total impact (C:H/I:H/A:H) consistent with SYSTEM-level compromise. The corroborating signals are consistent and point AWAY from urgent mass exploitation: EPSS is only 0.25% (15th percentile), CISA SSVC lists Exploitation=none and Automatable=no (race conditions are inherently hard to automate reliably), and there is no KEV listing and no public exploit. SSVC Technical Impact=total aligns with the C/I/A=High impact. The one tension worth noting is between the high technical impact and the low likelihood/automatability - this is a high-severity-if-exploited flaw but not a wormable, broadly-automated threat. No data is strongly conflicting; the main caveat is that only an MSRC reference is provided, so affected-build details come from EUVD rather than a parsed vendor advisory. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged local account (e.g., via phishing or a standard user session) runs a tool that repeatedly triggers the vulnerable Windows Performance Monitor code path, racing a shared resource to corrupt state at the right moment. On a successful race they gain SYSTEM privileges for full host takeover. No public exploit code is identified at time of analysis, and the high attack complexity (timing-dependent race) means exploitation may require many attempts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 16, 2026
Local privilege escalation in Microsoft Windows Performance Monitor lets an attacker who already holds a valid low-privileged local account repeatedly invoke the component, win a non-deterministic race condition on a shared resource, and escalate to higher privileges with high confidentiality, integrity and availability impact. Affected platforms per the CPE and EUVD data span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. Exploitation is constrained by local-only access and high attack complexity (CISA SSVC rates it non-automatable and no public exploit was identified at time of analysis); EPSS is low at 0.25% (15th percentile) and the flaw is not in CISA KEV, making this a genuine but moderate-priority local privilege escalation with a vendor patch available.
Earlier versions of this analysis (1)
Privilege elevation in Windows Performance Monitor lets a locally authenticated low-privileged attacker on an affected Windows host gain higher-integrity execution by winning a timing-dependent race condition (CWE-362) in the component's handling of a shared resource. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, score 6.7) confirms the attacker must already hold valid local low-privileged credentials and must also induce user interaction, while the high attack-complexity metric reflects that the race is narrow and not reliably winnable on any single attempt. No public exploit code has been identified and CISA's SSVC assessment records exploitation as "none"; vendor patches are available, so this is a genuine but moderate-priority issue that should be handled through normal monthly patch cycles rather than emergency response.
RemediationAI
Vendor-released patch is available: apply the current Microsoft cumulative security update for this CVE as mapped in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85333), which brings affected builds to the fixed thresholds published in the EUVD/NVD data - 10.0.14393.9612 for Windows 10 1607 and Server 2016, 10.0.17763.9376 for Windows 10 1809 and Server 2019, 10.0.19044.7807 for Windows 10 21H2 and 22H2, 10.0.20348.5761 for Server 2022, 10.0.26100.33650 for Server 2025, 10.0.26100.9711 for Windows 11 24H2, 10.0.22631.7652 for Windows 11 23H2, 10.0.26200.9711 for Windows 11 25H2, 10.0.28000.3231 for Windows 11 26H1, 10.0.26300.9711 for Windows 11 26H2, 6.2.9200.26434 for Server 2012 and 6.3.9600.23470 for Server 2012 R2, and prioritize systems where untrusted or non-administrative users have interactive local logon. No documented configuration workaround removes the flawed shared-resource synchronization, so until patching completes the actionable compensating controls are to constrain local interactive access: deny interactive logon to untrusted local accounts and remove unnecessary users from the 'Performance Log Users' and 'Performance Monitor Users' groups so ordinary accounts cannot drive the counter/logging subsystem, accepting the trade-off that legitimate monitoring agents and third-party APM tooling that rely on those groups will fail until membership is restored. Reducing the number of low-privileged accounts able to run perfmon is effective but operationally invasive on shared or jump hosts, and EDR detection of repeated performance-counter access is possible but noisy, since Windows monitoring agents legitimately produce similar telemetry.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-362, concurrent execution using a shared resource with improper synchronization, inside the Windows Performance Monitor subsystem (the perfmon MMC snap-in and the underlying performance counter / performance data helper infrastructure that brokers access to shared counter and logging objects). A low-privileged local process that can repeatedly drive the same code path can interleave its operations with a higher-privileged consumer of the shared object and win the timing window, yielding execution in a more privileged context. The CVSS:3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent with that model: it is strictly local, requires an existing low-privileged account, needs no user interaction, leaves scope unchanged, and inflicts total technical impact across confidentiality, integrity and availability per CISA SSVC (Technical Impact: total). The high attack complexity reflects a probabilistic, non-deterministic window that may fail repeatedly, and CISA's Automatable=no determination indicates the race cannot be triggered reliably at scale without bespoke work. Note the mild tagging inconsistency in the source data, which labels the CVE with an 'Information Disclosure' tag while the assessed vector and SSVC rating describe full privilege elevation with integrity and availability impact. CPE entries explicitly enumerate Windows 10 1607, 1809, 21H2 and 22H2 in x86, x64 and arm64 (21H2/22H2), and the accompanying tags extend coverage to Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2012 through 2025.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local race condition exploitable only by an existing low-privileged user who must win a timing window, so AV:L/AC:H/PR:L; successful escalation yields SYSTEM, giving full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A local privilege escalation flaw in Microsoft Windows Performance Monitor affects Windows 10, Windows 11, and Windows Server 2012 through 2025, including Server Core deployments across the organization's workstation and server estate. Because exploitation requires an attacker to already hold a valid low-privileged local account and to repeatedly win a timing-dependent race condition, the realistic risk is a malicious insider, a compromised service account, or an attacker who has already achieved an initial foothold attempting to expand access to administrative privileges. Leadership should treat this as a moderate-priority hardening item rather than an emergency, but it remains relevant to any organization whose threat model includes lateral movement and privilege escalation after an initial breach.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB