What is the CVSS score of EUVD-2026-56613?

EUVD-2026-56613 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows Work Folders are affected by EUVD-2026-56613?

CVE-2026-61349 affects Windows Work Folder Service across Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025, allowing local users to gain administrative control of affected…. A patch is available.

How to fix or mitigate EUVD-2026-56613?

Within 24 hours, inventory all Windows systems running Server 2012 R2 through 2025 and Windows 11 26H1 or earlier, and identify systems with multi-user access. Within 7 days, apply the vendor patch released by Microsoft for Windows Work Folder Service across all affected systems, prioritizing servers and high-value workstations. Within 30 days, complete patch deployment to all remaining systems, validate remediation, and ensure monitoring is in place to detect exploitation attempts.

Windows Work Folders EUVD-2026-56613

| CVE-2026-61349 HIGH

Race Condition (CWE-362)

2026-08-11 secure@microsoft.com

GHSA-p72q-6pvr-2q6j

Denial Of Service Race Condition Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition root cause (CWE-362) raises complexity to AC:H; all other metrics align with local low-privilege exploitation with full system impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 20:53 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 cve.org

HIGH 7.8

DescriptionCVE.org

Use after free in Windows Work Folder Service allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation in the Windows Work Folder Service allows an authenticated local attacker to gain SYSTEM-level privileges via a use-after-free memory corruption flaw rooted in a race condition (CWE-362). The vulnerability affects a wide range of Windows client and server releases from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. No public exploit has been identified at time of analysis, and SSVC assessment confirms no observed exploitation; however, technical impact is rated 'total,' indicating full system compromise is achievable if exploited.

Technical ContextAI

The affected component is the Windows Work Folder Service (a built-in Windows enterprise file-synchronization mechanism enabling users to sync corporate data to personal or managed devices). The root cause is CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization), which induces a use-after-free condition: when two or more threads or operations race to access or free the same memory object within the service, a freed memory region can subsequently be referenced. This class of flaw allows an attacker to achieve arbitrary code execution in the context of the service process, which typically runs at elevated privilege. The vulnerability is local-only (AV:L per CVSS), meaning the attacker must already have a foothold as a low-privileged authenticated user on the target system. The broad affected surface spans CPEs covering Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server editions 2012 R2 through 2025 (including Server Core variants), as catalogued by ENISA EUVD-2026-56613.

RemediationAI

The primary remediation is to apply Microsoft's released security update via Windows Update or WSUS, upgrading affected systems to the patched builds listed per OS version: Windows Server 2025 to 10.0.26100.33296, Windows Server 2022 to 10.0.20348.5499, Windows Server 2019 to 10.0.17763.9115, Windows Server 2016 to 10.0.14393.9418, Windows Server 2012 R2 to 6.3.9600.23337, Windows 11 26H1 to 10.0.28000.2704, Windows 11 25H2 to 10.0.26200.9168, Windows 11 24H2 to 10.0.26100.9168, Windows 11 23H2 to 10.0.22631.7517, Windows 10 21H2/22H2 to 10.0.19044.7663/10.0.19045.7663, and Windows 10 1607/1809 to their respective 9418/9115 patch levels. Refer to https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61349 for the authoritative patch manifest. As a compensating control where immediate patching is not possible, administrators can disable the Work Folders feature on systems where it is not operationally required by stopping and disabling the 'Work Folders' Windows service (SyncShareSvc) - note this will prevent users from syncing files via Work Folders. Additionally, restricting local logon rights to only necessary users via Group Policy reduces the attacker's ability to reach the vulnerable service. These controls do not eliminate the vulnerability and patching remains the definitive fix.