CVE-2026-71347: Windows Security Center Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Security Center allows an authorized attacker to elevate privileges locally.
Other sources
Windows Security Center Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9445Patch KB5124008 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9445Patch KB5124008 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.2954Patch KB5124012
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must already be authorized on the affected Windows 11 system and must be able to execute code locally. The issue is not described as remotely exploitable or requiring user interaction.
What level of access could an attacker gain?
Successful exploitation can elevate the privileges of a local authorized attacker. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability.
What vulnerability conditions are involved?
Exploitation involves concurrent execution against a shared resource with improper synchronization, described as a race condition. The listed weakness categories also include use after free.