CVE-2026-21221
HIGHCapability Access Management Service - Privilege Escalation
Title source: llmDescription
Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.
Scores
CVSS v3
7.0
EPSS
0.0005
EPSS Percentile
14.2%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-362
CWE-416
Status
published
Affected Products (5)
microsoft/windows_11_24h2
< 10.0.26100.7623
microsoft/windows_11_24h2
< 10.0.26100.7623
microsoft/windows_11_25h2
< 10.0.26200.7623
microsoft/windows_11_25h2
< 10.0.26200.7623
microsoft/windows_server_2025
< 10.0.26100.32230
Timeline
Published
Jan 13, 2026
Tracked Since
Feb 18, 2026