CVE-2026-20921 Overview
CVE-2026-20921 is a race condition vulnerability in the Windows Server Message Block (SMB) Server that allows an authenticated network-based attacker to elevate privileges. The flaw is classified under [CWE-362] as concurrent execution using a shared resource with improper synchronization. Microsoft published the advisory on January 13, 2026, covering supported versions of Windows 10, Windows 11, and Windows Server from 2008 through 2025.
Successful exploitation requires winning a timing window between concurrent SMB operations, which raises attack complexity but yields high impact on confidentiality, integrity, and availability.
Critical Impact
An authenticated attacker on the network can elevate privileges on the target SMB server, potentially gaining administrative control over the affected Windows host.
Affected Products
- Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 23H2, 24H2, 25H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2026-01-13 - CVE-2026-20921 published to NVD
- 2026-01-15 - Last updated in NVD database
Technical Details for CVE-2026-20921
Vulnerability Analysis
The vulnerability resides in the Windows SMB Server component, which handles file, printer, and named pipe sharing across Windows networks. SMB Server processes concurrent client requests using multi-threaded handlers that share internal state objects. When two or more threads access a shared resource without proper synchronization, the resulting race condition can leave the resource in an inconsistent state.
An authenticated attacker who can submit concurrent SMB requests to the server may manipulate this timing window. By winning the race, the attacker can cause the server to operate on attacker-controlled or stale state, leading to privilege elevation in the SMB Server process context. The advisory categorizes the weakness under [CWE-362], which covers improper synchronization of shared resources.
Root Cause
The root cause is missing or insufficient locking around a shared resource accessed by multiple SMB Server threads. Operations that should be atomic — for example, validating a session or handle and then acting on it — are split into discrete steps that another thread can interleave. This creates a time-of-check to time-of-use (TOCTOU) condition where the resource state changes between validation and use.
Attack Vector
The attack is delivered over the network and requires valid low-privilege credentials on the target. No user interaction is required. The attacker must reliably trigger the race window, which Microsoft reflects with high attack complexity. Exploitation produces high impact on confidentiality, integrity, and availability of the SMB Server host. No public proof-of-concept code or in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified exploitation code is publicly available. Refer to the Microsoft CVE-2026-20921 Advisory for vendor technical details.
Detection Methods for CVE-2026-20921
Indicators of Compromise
- Unexpected SMB session establishments from low-privileged accounts followed by privilege changes on the target host
- High volumes of concurrent SMB requests from a single source targeting the same handle, session, or named pipe
- Anomalous process spawning or token elevation events on hosts running the LanmanServer service
- New local administrator accounts or service installations correlated with prior SMB authentication events
Detection Strategies
- Monitor Windows Security event log IDs 4624, 4672, and 4688 for low-privilege SMB logons immediately followed by elevated token use
- Inspect SMB audit events (Microsoft-Windows-SMBServer/Audit and Operational channels) for repeated, near-simultaneous operations on the same resource
- Correlate network telemetry showing burst patterns of SMB2 requests with subsequent privilege changes on the destination host
Monitoring Recommendations
- Enable SMB server auditing and forward logs to a centralized analytics platform for cross-host correlation
- Baseline normal SMB session concurrency per source identity and alert on statistical outliers
- Track changes to privileged group membership and service installations on file servers and domain controllers
How to Mitigate CVE-2026-20921
Immediate Actions Required
- Apply Microsoft's January 2026 security update for all affected Windows 10, Windows 11, and Windows Server versions as identified in the vendor advisory
- Inventory exposed SMB servers and prioritize patching of internet-reachable and domain controller hosts
- Restrict SMB access to trusted management networks using host and perimeter firewalls
- Enforce least privilege so that compromised low-tier accounts cannot reach sensitive SMB shares
Patch Information
Microsoft has released security updates addressing CVE-2026-20921. Refer to the Microsoft CVE-2026-20921 Advisory for the specific KB articles and update packages corresponding to each affected Windows version.
Workarounds
- Block inbound TCP ports 139 and 445 at the network perimeter and between segmentation zones where SMB is not required
- Disable SMB Server on hosts that do not need to share files, printers, or named pipes
- Require SMB signing and enforce authentication to limit unauthenticated reach to the vulnerable code path
# Disable SMB Server on hosts that do not require file sharing
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
# Block inbound SMB at the host firewall
New-NetFirewallRule -DisplayName "Block-Inbound-SMB-445" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Block
New-NetFirewallRule -DisplayName "Block-Inbound-SMB-139" -Direction Inbound -Protocol TCP -LocalPort 139 -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
