Windows Server Update Service (WSUS) contains a race condition due to improper synchronization of a shared resource. The flaw creates a concurrency issue (CWE‑362) combined with a use‑after‑free scenario (CWE‑416). An attacker who is already authenticated on the local system can trigger concurrent operations and manipulate WSUS internal state, resulting in elevated privileges. Once the exploitation succeeds, the attacker can execute arbitrary code with administrative rights, modify system configuration, or deploy malware, effectively gaining full control of the machine.

All Windows 10 builds 1607 through 26H1, Windows 11 builds 23H2 to 26H1, and Windows Server editions from 2012 to 2025—including core installations—are affected. The vulnerability resides in the WSUS component that runs on these operating systems. Users of any of these versions should verify whether WSUS is installed and running on their systems.

The CVSS score of 7 denotes medium severity, and the lack of an EPSS score or CISA KEV listing suggests limited exploitation activity to date. Exploitation requires a local user with authorized credentials capable of invoking the race condition against WSUS. Once elevated, the attacker gains full administrative authority, presenting a high impact if not mitigated.