This vulnerability (CVE-2026-66802) involves a race condition (CWE-362) in Microsoft Azure Attestation and Device Health Attestation services on Windows 10 Version 1809 (build 10.0.17763.0). The improper synchronization of concurrent execution using shared resources can be exploited by an unauthorized attacker to execute code remotely. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction. Microsoft has released an official fix and manages remediation for this cloud service. No known exploits have been reported in the wild.

Successful exploitation allows remote code execution by an unauthorized attacker, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability affects critical attestation services that verify device health and identity, increasing the risk of trust violations in security-sensitive environments.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66802 to mitigate this vulnerability.