CVE-2026-68824

Summary

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.

Affected Software

VendorProductVersion RangeStatus
MicrosoftWindows 10 Version 21H210.0.19044.0 < 10.0.19044.7725affected
MicrosoftWindows 10 Version 22H210.0.19045.0 < 10.0.19045.7725affected
MicrosoftWindows 11 version 23H210.0.22631.0 < 10.0.22631.7582affected
MicrosoftWindows 11 Version 23H210.0.22631.0 < 10.0.22631.7582affected
MicrosoftWindows 11 Version 24H210.0.26100.0 < 10.0.26100.9445affected
MicrosoftWindows 11 Version 25H210.0.26200.0 < 10.0.26200.9445affected
MicrosoftWindows 11 version 26H110.0.28000.0 < 10.0.28000.2954affected
MicrosoftWindows Server 202210.0.20348.0 < 10.0.20348.5622affected
MicrosoftWindows Server 202510.0.26100.0 < 10.0.26100.33438affected
MicrosoftWindows Server 2025 (Server Core installation)10.0.26100.0 < 10.0.26100.33438affected

Weaknesses

  • CWE-362: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
  • CWE-416: CWE-416: Use After Free

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References