CVE-2026-96215
Status: AnalyzedHigh (7)—
Severity7High · CVSS 3.1
Exploitation probability0.19 %higher than 8% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally.
CVSS
- Base score
- 7
- Version
- 3.1
- Vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.19 %
- Percentile among all scored CVEs
- 8
- Score date
- 10/20/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1068Exploitation for Privilege Escalationprivilege escalation90 %
Condición de carrera (CWE-362) en Windows Autopilot con vector local (AV:L), PR:L y UI:N; el texto solo describe escalada de privilegios local, sin otro impacto explícito.
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
ATT&CK mitigations that cover these techniques
Affected technologies (4)
CWEs
- CWE-362
References
Show 1 references
Raw JSON (NVD)
Show
{
"id": "CVE-2026-96215",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-96215",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-10-13T19:47:43.352864Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1
}
]
},
"affected": [
{
"source": "secure@microsoft.com",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Windows 11 Version 24H2",
"versions": [
{
"status": "affected",
"version": "10.0.26100.0",
"lessThan": "10.0.26100.9711",
"versionType": "custom"
}
],
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 11 Version 25H2",
"versions": [
{
"status": "affected",
"version": "10.0.26200.0",
"lessThan": "10.0.26200.9711",
"versionType": "custom"
}
],
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 11 version 26H1",
"versions": [
{
"status": "affected",
"version": "10.0.28000.0",
"lessThan": "10.0.28000.3231",
"versionType": "custom"
}
],
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 11 Version 26H2",
"versions": [
{
"status": "affected",
"version": "10.0.26300.0",
"lessThan": "10.0.26300.9711",
"versionType": "custom"
}
],
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
]
}
]
}
],
"published": "2026-10-13T19:21:47.117",
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96215",
"tags": [
"Vendor Advisory"
],
"source": "secure@microsoft.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"description": [
{
"lang": "en",
"value": "CWE-362"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally."
}
],
"lastModified": "2026-10-16T14:59:27.587",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*",
"vulnerable": true,
"matchCriteriaId": "E2A85326-7BE4-4F2C-AF37-45FD4B939D07",
"versionEndExcluding": "10.0.26100.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "03291588-C7D5-445C-AD9F-03D3ADE6BE8A",
"versionEndExcluding": "10.0.26100.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*",
"vulnerable": true,
"matchCriteriaId": "5E5700DF-EF80-4D08-9B32-E0481EAE8147",
"versionEndExcluding": "10.0.26200.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "BA7D90B4-6AD5-4EF9-8709-01E4CED31779",
"versionEndExcluding": "10.0.26200.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*",
"vulnerable": true,
"matchCriteriaId": "EC0260C7-D6B6-487F-B304-CAAE72608BF7",
"versionEndExcluding": "10.0.28000.3231"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "8DA3AD5D-32C0-4AC9-A856-512106D42CC7",
"versionEndExcluding": "10.0.28000.3231"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:arm64:*",
"vulnerable": true,
"matchCriteriaId": "8D5DCA1A-EF56-43AF-B079-011AE5C2F846",
"versionEndExcluding": "10.0.26300.9711"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "38D4479B-ACB0-4DC7-A4B1-F448C5B2EBD8",
"versionEndExcluding": "10.0.26300.9711"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secure@microsoft.com"
}