MicrosoftCVE-2026-58598
Microsoft Windows Backup Engine: race condition
High7.0CVE-2026-58598 · Published Jul 16, 2026 · updated Jul 22, 2026
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Windows 10 Version 21H2 Product | >= 10.0.19044.0, < 10.0.19044.7548 | 10.0.19044.7548 |
| Windows 10 Version 22H2 Product | >= 10.0.19045.0, < 10.0.19045.7548 | 10.0.19045.7548 |
| Windows 11 Version 24H2 Product | >= 10.0.26100.0, < 10.0.26100.8875 | 10.0.26100.8875 |
| Windows 11 Version 25H2 Product | >= 10.0.26200.0, < 10.0.26200.8875 | 10.0.26200.8875 |
| Windows 11 version 26H1 Product | >= 10.0.28000.0, < 10.0.28000.2525 | 10.0.28000.2525 |
Details and references
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 17 | Microsoft Edge (Chromium-based): authentication bypass | Medium5.4 | 150.0.4078.80 |
| Jul 17 | Microsoft Windows RDP: unauthorized attacker could disclose information over | High7.1 | 2.1.65.2+1 more |
| Jul 16 | Microsoft Windows Admin Center: cross-site scripting | Medium6.1 | 2.6.7 |
| Jul 16 | Microsoft Windows Terminal App: integer overflow | High7.5 | 1.24.11321.0 |
| Jul 16 | Microsoft Office SharePoint: cross-site scripting | Medium4.6 | 16.0.5561.1001+2 more |
| Jul 14 | Secret exfiltration vulnerability | High | 1.128.1 |