CVE-2026-20856

CVE-2026-20856 is a Windows Server Update Services (WSUS) remote code execution vulnerability caused by improper input validation. Exploitation is possible over a network with no user interaction; CVSSv3.1 base score 8.1 (High). Public references note this is addressed by January 2026 security up...

Windows SMB Server Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows SMB Server allows an authorized attacker to elevate privileges over a network...

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute code over a network...

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to execute code over a network...

Windows Kerberos Elevation of Privilege Vulnerability

Reliance on untrusted inputs in a security decision in Windows Kerberos allows an authorized attacker to elevate privileges over a network...

Windows SMB Server Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows SMB Server allows an authorized attacker to elevate privileges over a network...

Windows SMB Server Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows SMB Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-20803: Missing Authentication for Critical Function

Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-20926: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows SMB Server allows an authorized attacker to elevate privileges over a network...

PT-2026-2656

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server affected versions not specified Description A missing authentication check for a critical function in Microsoft SQL Server can allow an authorized attacker to elevate privileges over a network. The issue, caused by missing...

CVE-2026-20929: Improper Access Control

Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network...

CVE-2026-20927: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows SMB Server allows an authorized attacker to deny service over a network...

PT-2026-6441

Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network...

CVE-2026-20919: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows SMB Server allows an authorized attacker to elevate privileges over a network...

PT-2026-2701

Name of the Vulnerable Software and Affected Versions Windows Server Update Service affected versions not specified Description A flaw in input validation within Windows Server Update Service could allow a remote attacker to execute code on the network. This could lead to arbitrary code execution...

PT-2026-2726

Name of the Vulnerable Software and Affected Versions Windows SMB Server affected versions not specified Description A flaw in Windows SMB Server related to concurrent execution using a shared resource with improper synchronization, specifically a race condition, could allow an authorized attacke...

CVE-2026-20849: Reliance on Untrusted Inputs in a Security Decision

Reliance on untrusted inputs in a security decision in Windows Kerberos allows an authorized attacker to elevate privileges over a network...

CVE-2026-20875: NULL Pointer Dereference

Null pointer dereference in Windows Local Security Authority Subsystem Service LSASS allows an unauthorized attacker to deny service over a network...

CVE-2026-20925: External Control of File Name or Path

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-20934: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows SMB Server allows an authorized attacker to elevate privileges over a network...