CVE-2026-68824: Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.
Other sources
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running Microsoft Windows 10, Windows 11, Windows Server 2022, or Windows Server 2025 are listed as affected. Exploitation is local, so the attacker must already be able to execute on the target system.
What access does an attacker need to exploit it?
The attacker needs authorized local access with low privileges. No user interaction is required, but exploitation has high attack complexity because it depends on a race condition involving a shared resource.
What is the potential impact if exploitation succeeds?
A successful exploit can elevate the attacker’s privileges locally. The reported impact includes high confidentiality, integrity, and availability effects.