This vulnerability involves concurrent execution using a shared resource with improper synchronization (CWE-362) in Windows Server Update Service on Windows 10 Version 1607 (build 10.0.14393.0). An authorized local attacker can exploit this race condition to elevate privileges. The CVSS v3.1 base score is 7.0, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this race condition to elevate their privileges, potentially gaining higher system rights than intended. This could lead to full system compromise depending on the privileges escalated. The vulnerability affects confidentiality, integrity, and availability of the affected system.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26174 to remediate this vulnerability.