CVE-2026-20860

CVE Database · CVE-2026-20860

CVE-2026-20860

· HIGHAnalyzed

CVSS v3.1

7.8

EPSS

7.98%

Published

Jan 13, 2026

Modified

Jan 15, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-843

Affected Products (19)

microsoft · windows_10_1607 (up to 10.0.14393.8783)vulnerable

microsoft · windows_10_1809 (up to 10.0.17763.8276)vulnerable

microsoft · windows_10_21h2 (up to 10.0.19044.6809)vulnerable

microsoft · windows_10_22h2 (up to 10.0.19045.6809)vulnerable

microsoft · windows_11_23h2 (up to 10.0.22631.6491)vulnerable

microsoft · windows_11_24h2 (up to 10.0.26100.7623)vulnerable

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20860

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs