AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MicrosoftCVE-2026-58598

Microsoft Windows Backup Engine: race condition

Microsoft

CVE-2026-58598 · Published Jul 16, 2026 · updated Jul 22, 2026

High7.0
Fix: upgrade to 10.0.19044.7548 or later (5 fixed versions below)
Microsoft advisory

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

Affected versions

PackageAffectedFixed in
Windows 10 Version 21H2
Product
>= 10.0.19044.0, < 10.0.19044.754810.0.19044.7548
Windows 10 Version 22H2
Product
>= 10.0.19045.0, < 10.0.19045.754810.0.19045.7548
Windows 11 Version 24H2
Product
>= 10.0.26100.0, < 10.0.26100.887510.0.26100.8875
Windows 11 Version 25H2
Product
>= 10.0.26200.0, < 10.0.26200.887510.0.26200.8875
Windows 11 version 26H1
Product
>= 10.0.28000.0, < 10.0.28000.252510.0.28000.2525
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-362, CWE-416

More Microsoft advisories

All Microsoft
Medium 5.4Jul 17Microsoft Edge (Chromium-based): authentication bypassCVE-2026-57980fixed in 150.0.4078.80High 7.1Jul 17Microsoft Windows RDP: unauthorized attacker could disclose information overCVE-2026-56171fixed in 2.1.65.2 +1Medium 6.1Jul 16Microsoft Windows Admin Center: cross-site scriptingCVE-2026-58643fixed in 2.6.7High 7.5Jul 16Microsoft Windows Terminal App: integer overflowCVE-2026-59117fixed in 1.24.11321.0Medium 4.6Jul 16Microsoft Office SharePoint: cross-site scriptingCVE-2026-62826fixed in 16.0.5561.1001 +2HighJul 14Secret exfiltration vulnerabilityCVE-2026-47282fixed in 1.128.1