Aug 2026: Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability: CVE-2026-66802 August 2026

Aug 2026: Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
CVE-2026-66802 Published on August 11, 2026

Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to execute code over a network.

Weakness Types

What is a Race Condition Vulnerability?

The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

CVE-2026-66802 has been classified to as a Race Condition vulnerability or weakness.

What is a Dangling pointer Vulnerability?

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

CVE-2026-66802 has been classified to as a Dangling pointer vulnerability or weakness.

Products Associated with CVE-2026-66802

Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.

Affected Versions

Version 10.0.17763.0 and below 10.0.17763.9115 is affected.

Version 10.0.28000.0 and below 10.0.28000.2704 is affected.