CVE Watch30 jul 2026

CVE-2026-20860

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker

CVSS

7.8

Alto

EPSS

8.3%

p95

KEV

—

Exploit Today

0-100

Publicado: 13 ene 2026 · Última mod.: 30 jul 2026 · CWE-843

EPSS · 30d

8.3%EPSS · 30 días8.4%

2026-10-012026-10-29

Descripción técnica

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Referencias oficiales

msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20860

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-961877.4 ALT

—

——0Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.6h CVE-2026-880905.4 MED

—

——0Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.16h CVE-2026-1185108.8 ALT

20.7%

——6A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.1d CVE-2026-627657.5 ALT

38.1%

——11Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.6h CVE-2026-858988.8 ALT

55.4%

——17Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.1d CVE-2026-1145987.5 ALT

22.5%

——7In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.2d