This vulnerability (CVE-2026-20930) involves a race condition (CWE-362) in Windows Management Services on Windows 10 Version 1809 (build 10.0.17763.0). The flaw arises from improper synchronization when multiple processes concurrently access a shared resource, enabling an authorized local attacker to elevate privileges. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability, with attack vector local, high attack complexity, and requiring low privileges but no user interaction. Microsoft has published an official fix to remediate this vulnerability.

Successful exploitation allows an authorized local attacker to elevate privileges on the affected system, potentially gaining higher-level access than intended. This can lead to full system compromise, affecting confidentiality, integrity, and availability of the system. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20930 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor.