VDB
CVE-2026-24295
CVE-2026-24295
PUBLISHED
CVSS 7 HIGH
Windows Device Association Service Elevation of Privilege Vulnerability
Reported by microsoft · Published March 10, 2026
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| windows_11_25h2 | microsoft | 10.0.26200.7979 |
| windows_11_23h2 | microsoft | 10.0.22631.6783 |
| Windows 10 Version 1607 | Microsoft | 10.0.14393.8957 |
| windows_11_26h1 | microsoft | 10.0.28000.1719 |
Risk scores
CVSS 3.1
7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows 10 Version 1607 | 10.0.14393.0 |
| Microsoft | Windows 10 Version 1809 | 10.0.17763.0 |
| Microsoft | Windows 10 Version 21H2 | 10.0.19044.0 |
| Microsoft | Windows 10 Version 22H2 | 10.0.19045.0 |
| Microsoft | Windows 11 version 22H3 | 10.0.22631.0 |
| Microsoft | Windows 11 Version 23H2 | 10.0.22631.0 |
| Microsoft | Windows 11 Version 24H2 | 10.0.26100.0 |
| Microsoft | Windows 11 Version 25H2 | 10.0.26200.0 |
| Microsoft | Windows 11 version 26H1 | 10.0.28000.0 |
| Microsoft | Windows Server 2016 | 10.0.14393.0 |
| Microsoft | Windows Server 2016 (Server Core installation) | 10.0.14393.0 |
| Microsoft | Windows Server 2019 | 10.0.17763.0 |
| Microsoft | Windows Server 2019 (Server Core installation) | 10.0.17763.0 |
| Microsoft | Windows Server 2022 | 10.0.20348.0 |
| Microsoft | Windows Server 2022, 23H2 Edition (Server Core installation) | 10.0.25398.0 |
| Microsoft | Windows Server 2025 | 10.0.26100.0 |
| Microsoft | Windows Server 2025 (Server Core installation) | 10.0.26100.0 |
| Microsoft | Windows 10 Version 1607 | 10.0.14393.0 |
| microsoft | windows_server_2019 | 10.0.17763.0 |
| Microsoft | Windows 11 version 26H1 | 10.0.28000.0 |
…and 28 more
Timeline
- Mar 10, 2026 CVE Published
- Mar 11, 2026 EPSS Score (30 in total, the first dated here)
- Mar 17, 2026 Security Advisory (56 in total, the first dated here)
- Mar 22, 2026 Coalition ESS Score (2 in total, the first dated here)
- Jun 19, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-24295
vulnetix vdb fixes CVE-2026-24295Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-24295/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- Windows Device Association Service Elevation of Privilege Vulnerability vendor-advisorypatch