Log in Start free

Vulnerability · Published Feb 10, 2026 · Assigned by microsoft

CVE-2026-21237Windows Subsystem for Linux Elevation of Privilege Vulnerability

High 7.0

In plain English

A high-severity race condition in Windows 10 Version 21H2 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.3%top 80.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

Affected products (as reported)

VendorProductVersions
Microsoft Windows 10 Version 21H2 10.0.19044.0 – before 10.0.19044.6937
Microsoft Windows 10 Version 22H2 10.0.19045.0 – before 10.0.19045.6937
Microsoft Windows 11 version 22H3 10.0.22631.0 – before 10.0.22631.6649
Microsoft Windows 11 Version 23H2 10.0.22631.0 – before 10.0.22631.6649
Microsoft Windows 11 Version 24H2 10.0.26100.0 – before 10.0.26100.7840
Microsoft Windows 11 Version 25H2 10.0.26200.0 – before 10.0.26200.7840
Microsoft Windows 11 version 26H1 10.0.28000.0 – before 10.0.28000.1575
Microsoft Windows 11 Version 26H1 10.0.28000.0 – before 10.0.28000.1575
Microsoft Windows Server 2022 10.0.20348.0 – before 10.0.20348.4773
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.0 – before 10.0.25398.2149
Microsoft Windows Server 2025 10.0.26100.0 – before 10.0.26100.32370
Microsoft Windows Server 2025 (Server Core installation) 10.0.26100.0 – before 10.0.26100.32370

Weakness: CWE-362, CWE-416 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

References