CVE-2026-103568

Microsoft · Published October 13, 2026

7.8

CVSS v3.1

HIGH

Patch availableGet patch

Description

Windows Credential Providers Elevation of Privilege Vulnerability. Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.

Affected Products

Windows Server 2012
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C