CVE-2026-20815 Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability

Api.Msrc.Microsoft • January 13, 2026

Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in Capability Access Management Service (camsvc) Several vulnerabilities have been identified in the Capability Access Management Service (camsvc), including two elevation of privilege vulnerabilities (CVE-2026-20830, CVE-2026-20815, CVE-2026-21221) and two information disclosure vulnerabilities (CVE-2026-20851, CVE-2026-20835). These vulnerabilities allow authorized and unauthorized attackers to elevate privileges and disclose information locally, respectively, due to improper synchronization and out-of-bounds read issues. 5 sources 35

Extracted Entities

CVEs (1)

CVE-2026-20815