Windows 10 1607: Race condition in Windows Security Center

Summary

A race condition (CWE-362, CWE-416) in the Windows Security Center component of Windows 10 Version 1607 allows an authorized local attacker to elevate privileges. The attacker needs code execution or a logged-in session on the machine and must win a timing race, which makes exploitation harder. Microsoft's records list the flaw with CVSS 3.1 7.0 (PR:L) in NVD-based sources, while a mirror shows 6.4 (PR:H); verify the current vector in NVD. Windows 10 Version 1607 reached end of updates on October 13, 2026.

Affected

• Windows 10 Version 1607 (Enterprise LTSB 2016): builds below 10.0.14393.9612, x86 and x64
• Per the CVE record, also affected: Windows 10 1809 below 10.0.17763.9376; 21H2 and 22H2 below 10.0.19044.7807 and 10.0.19045.7807; Windows 11 23H2 below 10.0.22631.7652; 24H2 and 25H2 below 10.0.26100.9711 and 10.0.26200.9711; 26H1 below 10.0.28000.3231; 26H2 below 10.0.26300.9711

Fixed in

• Windows 10 Version 1607: build 10.0.14393.9612, delivered with update KB5126868 (October 13, 2026)
• Other versions: see the fixed builds listed above

Workaround

Unknown. No vendor workaround was found for this CVE.

Exploitation

• No evidence of exploitation in the wild was found.
• CISA SSVC data lists exploitation as none and automatable as no.
• The CVE is not in the CISA KEV catalog. EPSS is very low (about 0.00246).
• No public proof of concept was found; this does not rule one out.

Our recommendation

• Patch with KB5126868 where possible. Test first, because Microsoft notes a mitigated Exchange/OWA email issue linked to this update.
• Since 1607 receives no further standard updates, plan migration to Windows 11 Enterprise LTSC 2024 or check whether Extended Security Updates are available for your devices.
• Prioritise shared, multi-user, kiosk, POS and HMI systems still on 1607.
• Restrict local logon and monitor for privilege-escalation activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-71347 msrc.microsoft.com
• Microsoft release health: Windows 10 1607 and Windows Server 2016 status learn.microsoft.com
• 4sysops: Windows 10 Enterprise LTSB 2016 end of support and ESU 4sysops.com
• NVD mirror (vulners): CVE-2026-71347 vulners.com
• OpenCVE: CVE-2026-71347 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:48.