CVE-2026-58598 HIGH

CVE-2026-58598: Windows Backup Service Elevation of Privilege Vulnerability

Vendor Microsoft

Product Windows 10 Version 21H2

Weakness CWE-362

Published July 16, 2026

Last update July 24, 2026

View on NVD All CVEs

CVSS base score

7.0/10

Attack vector Local

Attack complexity High

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

What the vulnerability does

01Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

Key dates

02Disclosure timeline

July 16, 2026 CVE published

July 24, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-58598 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/362.html AskarLabs — CWE-362 write-up Race Condition

Related vulnerabilities

Identifiers

CVE CVE-2026-58598

CWE CWE-362

CVSS 7.0 / HIGH

Affected versions

Vendor Microsoft

Product Windows 10 Version 21H2

Affected ≥ 10.0.19044.0 and < 10.0.19044.7548

Vendor Microsoft

Product Windows 10 Version 22H2

Affected ≥ 10.0.19045.0 and < 10.0.19045.7548

Vendor Microsoft

Product Windows 11 Version 24H2

Affected ≥ 10.0.26100.0 and < 10.0.26100.8875

Vendor Microsoft

Product Windows 11 Version 25H2

Affected ≥ 10.0.26200.0 and < 10.0.26200.8875

Vendor Microsoft

Product Windows 11 version 26H1

Affected ≥ 10.0.28000.0 and < 10.0.28000.2525

CVE-2026-58598: Windows Backup Service Elevation of Privilege Vulnerability

01Description

02Disclosure timeline

03References

04Related CVE