CVE-2026-71347ImportantFix has a known issueEoPLocal

Windows Security Center Elevation of Privilege Vulnerability

MSRC advisory NVD CVE.org

Assessment

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Security Center allows an authorized attacker to elevate privileges locally.

Severity: Important
CVSS base score: 6.4CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Impact: Elevation of Privilege
EPSS, next 30 days: Not scored yet
Public exploit code: No Nuclei template lists it
Exploitability: Exploitation Less Likely
Publicly disclosed: No
Customer action: Required: apply the update
Component: Windows Security Center
Weakness: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Issued by: Microsoft
Published: 13 Oct 2026 · October 2026
Last revised: 13 Oct 2026

CVSS 3.1 base metricsRed raises the risk · green lowers it

Attack vector: LocalAV:L
Attack complexity: HighAC:H
Privileges required: HighPR:H
User interaction: NoneUI:N
Scope: UnchangedS:U
Confidentiality: HighC:H
Integrity: HighI:H
Availability: HighA:H

Updates that fix it

2 KBs

KB	Type	Restart	Applies to	Known issues	Other CVEs
KB5124008	Security Update	Required	Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems and 1 more	MitigatedUSB audio devices might fail to start or produce no soundResolvedDomain-joined devices might lose their secure trust relationship with the domainResolvedRemote Desktop Services might stop responding after Sept. 2026 security updateResolvedHost folder shares might be unavailable in Hyper-V-based Linux VMs	All CVEs in KB5124008
KB5124012	Security Update	Required	Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems	MitigatedUSB audio devices might fail to start or produce no soundResolvedDomain-joined devices might lose their secure trust relationship with the domainResolvedRemote Desktop Services might stop responding after Sept. 2026 security updateResolvedHost folder shares might be unavailable in Hyper-V-based Linux VMs	All CVEs in KB5124012

Affected products

Windows

6 affected products

What changed

First observed 14 Oct 2026

No field changes in the recorded history.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.