Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability (Microsoft Windows 10 Version 1607)

CVE-2026-83666

HIGH 7.0

En bref

Source: NVD
EPSS: EPSS 0.22 % · centile 13 (2026-10-31)
État: PUBLISHED
Publiée: 2026-10-13 18:59 UTC
Mise à jour: 2026-10-31 18:02 UTC
Attribuée par: microsoft
Statut NVD: Analyzed

Rechercher sur…

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.

Faiblesses (CWE)

CWE-362 — Situation de compétition

Références

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83666

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	microsoft
CVSS 3.1	HIGH 7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · secure@microsoft.com (Secondary)

Références européennes

ENISA EUVD · EUVD-2026-99320
GCVE · GCVE-0-2026-83666

Avis du CERT-FR

CERTFR-2026-AVI-1314 — Multiples vulnérabilités dans Microsoft Windows · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* < 10.0.14393.9612
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* < 10.0.14393.9612
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* < 10.0.17763.9376
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* < 10.0.17763.9376
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* < 10.0.14393.9612
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* < 10.0.17763.9376
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:x64:* < 10.0.20348.5761
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:* < 10.0.26100.33650

Produits affectés

Produit	Versions
Microsoft · Windows 10 Version 1607	affected 10.0.14393.0 < 10.0.14393.9612
Microsoft · Windows 10 Version 1809	affected 10.0.17763.0 < 10.0.17763.9376
Microsoft · Windows Server 2012	affected 6.2.9200.0 < 6.2.9200.26434
Microsoft · Windows Server 2012 (Server Core installation)	affected 6.2.9200.0 < 6.2.9200.26434
Microsoft · Windows Server 2012 R2	affected 6.3.9600.0 < 6.3.9600.23470
Microsoft · Windows Server 2012 R2 (Server Core installation)	affected 6.3.9600.0 < 6.3.9600.23470
Microsoft · Windows Server 2016	affected 10.0.14393.0 < 10.0.14393.9612
Microsoft · Windows Server 2016 (Server Core installation)	affected 10.0.14393.0 < 10.0.14393.9612
Microsoft · Windows Server 2019	affected 10.0.17763.0 < 10.0.17763.9376
Microsoft · Windows Server 2019 (Server Core installation)	affected 10.0.17763.0 < 10.0.17763.9376
Microsoft · Windows Server 2022	affected 10.0.20348.0 < 10.0.20348.5761
Microsoft · Windows Server 2025	affected 10.0.26100.0 < 10.0.26100.33650
Microsoft · Windows Server 2025 (Server Core installation)	affected 10.0.26100.0 < 10.0.26100.33650

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability (Microsoft Windows 10 Version 1607)