7.8

CVE-2026-58628

Windows Wireless Network Manager Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Wireless Networking allows an authorized attacker to elevate privileges locally.
Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ Windows 10 1809 HwPlatform x64 Version < 10.0.17763.9020
Microsoft ≫ Windows 10 1809 HwPlatform x86 Version < 10.0.17763.9020
Microsoft ≫ Windows 10 21h2 HwPlatform arm64 Version < 10.0.19044.7548
Microsoft ≫ Windows 10 21h2 HwPlatform x64 Version < 10.0.19044.7548
Microsoft ≫ Windows 10 21h2 HwPlatform x86 Version < 10.0.19044.7548
Microsoft ≫ Windows 10 22h2 HwPlatform arm64 Version < 10.0.19045.7548
Microsoft ≫ Windows 10 22h2 HwPlatform x64 Version < 10.0.19045.7548
Microsoft ≫ Windows 10 22h2 HwPlatform x86 Version < 10.0.19045.7548
Microsoft ≫ Windows 11 24h2 HwPlatform arm64 Version < 10.0.26100.8875
Microsoft ≫ Windows 11 24h2 HwPlatform x64 Version < 10.0.26100.8875
Microsoft ≫ Windows 11 25h2 HwPlatform arm64 Version < 10.0.26200.8875
Microsoft ≫ Windows 11 25h2 HwPlatform x64 Version < 10.0.26200.8875
Microsoft ≫ Windows 11 26h1 HwPlatform arm64 Version < 10.0.28000.2269
Microsoft ≫ Windows 11 26h1 HwPlatform x64 Version < 10.0.28000.2269
Microsoft ≫ Windows Server 2019 SwEdition - HwPlatform x64 Version < 10.0.17763.9020
Microsoft ≫ Windows Server 2022 HwPlatform x64 Version < 10.0.20348.5386
Microsoft ≫ Windows Server 2025 HwPlatform x64 Version < 10.0.26100.33158
VulnDex Vulnerability Enrichment
This information is available to logged-in users. Login Login
No warning was found for this CVE.
EPSS Metrics
Type Source Score Percentile
EPSS FIRST.org 0.18% 0.079
CVSS Metrics
Source Base Score Exploit Score Impact Score Vector string
Microsoft 7.8 1.1 6
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58628
Patch
Vendor Advisory