High · 7.0 CVE-2026-58598 EUVD-2026-45061GHSA-v83q-c28h-3q53

Windows Backup Service Elevation of Privilege Vulnerability

Published Jul 16, 2026 · Updated Nov 10, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Windows 10 Version 21H2 Product: Windows 10 Version 22H2 Product: Windows 11 Version 24H2 Product: Windows 11 Version 25H2 Product: Windows 11 version 26H1 Platform: Windows

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Windows 10 Version 21H2	10.0.19044.0 – < 10.0.19044.7548	10.0.19044.7548
Microsoft	Windows 10 Version 22H2	10.0.19045.0 – < 10.0.19045.7548	10.0.19045.7548
Microsoft	Windows 11 Version 24H2	10.0.26100.0 – < 10.0.26100.8875	10.0.26100.8875
Microsoft	Windows 11 Version 25H2	10.0.26200.0 – < 10.0.26200.8875	10.0.26200.8875
Microsoft	Windows 11 version 26H1	10.0.28000.0 – < 10.0.28000.2525	10.0.28000.2525

Advisories 2

WID-SEC-2026-2401 Microsoft Windows: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 19, 2026
MSRC-CVE-2026-58598 Windows Backup Service Elevation of Privilege Vulnerability Microsoft Security Response Center · Jul 16, 2026

References

Windows Backup Service Elevation of Privilege Vulnerability vendor-advisory patch