Intel

CVE-2026-61352

microsoft windows_10_1607: Race-Condition

highEPSS 0.5%

Affected

  • microsoft/windows_10_1607 lt *..10.0.14393.9418
  • microsoft/windows_10_1607 lt *..10.0.14393.9418
  • microsoft/windows_10_1809 lt *..10.0.17763.9115
  • microsoft/windows_10_1809 lt *..10.0.17763.9115
  • microsoft/windows_10_21h2 lt *..10.0.19044.7663
  • microsoft/windows_10_21h2 lt *..10.0.19044.7663
  • microsoft/windows_10_21h2 lt *..10.0.19044.7663
  • microsoft/windows_10_22h2 lt *..10.0.19045.7663
  • microsoft/windows_10_22h2 lt *..10.0.19045.7663
  • microsoft/windows_10_22h2 lt *..10.0.19045.7663
  • microsoft/windows_11_23h2 lt *..10.0.22631.7517
  • microsoft/windows_11_23h2 lt *..10.0.22631.7517
  • microsoft/windows_11_24h2 lt *..10.0.26100.9106
  • microsoft/windows_11_24h2 lt *..10.0.26100.9106
  • microsoft/windows_11_25h2 lt *..10.0.26200.9106
  • microsoft/windows_11_25h2 lt *..10.0.26200.9106
  • microsoft/windows_11_26h1 lt *..10.0.28000.2704
  • microsoft/windows_11_26h1 lt *..10.0.28000.2704
  • microsoft/windows_server_2016 lt *..10.0.14393.9418
  • microsoft/windows_server_2019 lt *..10.0.17763.9115
  • microsoft/windows_server_2022 lt *..10.0.20348.5440
  • microsoft/windows_server_2025 lt *..10.0.26100.33222

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Source: cvelistv5NVD (NIST)Microsoft Security Update GuideBSI WID PortalBSI CSAF

Affected operating systems

  • windows

    microsoft / windows_10_1607

  • windows

    microsoft / windows_10_1809

  • windows

    microsoft / windows_10_21h2

  • windows

    microsoft / windows_10_22h2

  • windows

    microsoft / windows_11_23h2

  • windows

    microsoft / windows_11_24h2

  • windows

    microsoft / windows_11_25h2

  • windows

    microsoft / windows_11_26h1

  • windows

    microsoft / windows_server_2012r2

  • windows

    microsoft / windows_server_2012

  • windows

    microsoft / windows_server_2016

  • windows

    microsoft / windows_server_2019

  • windows

    microsoft / windows_server_2022

  • windows

    microsoft / windows_server_2025

Metrics

XIEM Effective CVSS
8.1
Source: nvd-v3
EPSS percentile
38.4 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
high
Priority score
74.31
Exploit maturity
no public PoC known
CVSS v3
7.5
EPSS score
0.5 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-08-11 17:05 UTC
CWE
CWE-362

Weakness classes (CWE)

  • CWE-362Class

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

    The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-08-16 19:16 UTC· secure@microsoft.com
    • Affected: Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2 (+17) → Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2 (+17)
  2. CVE Modified2026-08-11 22:17 UTC· secure@microsoft.com
    • Affected: Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2 (+17) → Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2 (+17)
  3. New CVE Received2026-08-11 17:18 UTC· secure@microsoft.com
    • Affected: Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2 (+17)
    • Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
    • CVSS V3.1: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
    • CWE: CWE-362

Linked advisories