---
id: "CVE-2026-95976"
page: "https://infrastack.ai/live/CVE-2026-95976"
kind: "vulnerability"
aliases: ["CVE-2026-95976"]
title: "Windows Diagnostic Policy Service race condition lets a local user gain higher privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Diagnostic Policy Service", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "windows", "windows-server"]
not_affected_if: ["no-local-untrusted-users"]
published_at: "2026-11-10T19:21:54+00:00"
first_seen_at: "2026-11-10T19:25:25+00:00"
updated_at: "2026-11-10T20:15:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95976", "first_seen_at": "2026-11-10T19:25:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T20:15:44+00:00"}]
exploit_sources: []
---

# Windows Diagnostic Policy Service race condition lets a local user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-95976 (this .md is for agents)

A race condition in the Windows Diagnostic Policy Service lets an attacker who already has a local account raise their privileges. The sources do not describe the exploitation details beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Diagnostic Policy Service affected range not listed fixed no fixed version listed

## How to check

Look up CVE-2026-95976 in the Microsoft Security Update Guide (msrc.microsoft.com/update-guide), find your Windows edition and build, and compare with 'winver' (or 'Get-ComputerInfo OsBuildNumber'). Affected builds and the fixing KB are not yet confirmed. DPS is on by default on Windows, so 'sc query DPS' showing RUNNING does not by itself show exposure.

## Timeline

- 2026-11-10T19:25:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95976
- 2026-11-10T20:15:44+00:00 analyst — MSRC advisory (3 URL forms) and NVD pages returned no content via web-cli; no primary source read, so no versions, fix or verification. Kept NVD description only (race condition in DPS, local EoP, CVSS 7.0 AV:L/AC:H/PR:L). Revisit when MSRC page is indexed.

## From the sources

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_