Advisoriesby IbisMicrosoftCVE-2026-83666
Microsoft Windows: race condition
Fix: upgrade to 10.0.14393.9612 or later (6 fixed versions below)
Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Windows 10 Version 1607 Product | >= 10.0.14393.0, < 10.0.14393.9612 | 10.0.14393.9612 |
| Windows 10 Version 1809 Product | >= 10.0.17763.0, < 10.0.17763.9376 | 10.0.17763.9376 |
| Windows Server 2012 Product | >= 6.2.9200.0, < 6.2.9200.26434 | 6.2.9200.26434 |
| Windows Server 2012 (Server Core installation) Product | >= 6.2.9200.0, < 6.2.9200.26434 | 6.2.9200.26434 |
| Windows Server 2012 R2 Product | >= 6.3.9600.0, < 6.3.9600.23470 | 6.3.9600.23470 |
| Windows Server 2012 R2 (Server Core installation) Product | >= 6.3.9600.0, < 6.3.9600.23470 | 6.3.9600.23470 |
| Windows Server 2016 Product | >= 10.0.14393.0, < 10.0.14393.9612 | 10.0.14393.9612 |
| Windows Server 2016 (Server Core installation) Product | >= 10.0.14393.0, < 10.0.14393.9612 | 10.0.14393.9612 |
| Windows Server 2019 Product | >= 10.0.17763.0, < 10.0.17763.9376 | 10.0.17763.9376 |
| Windows Server 2019 (Server Core installation) Product | >= 10.0.17763.0, < 10.0.17763.9376 | 10.0.17763.9376 |
| Windows Server 2022 Product | >= 10.0.20348.0, < 10.0.20348.5761 | 10.0.20348.5761 |
| Windows Server 2025 Product | >= 10.0.26100.0, < 10.0.26100.33650 | 10.0.26100.33650 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-362