CVE-2026-21508
7.0
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.0 / Impact: 5.9
Source: NVD
Description
Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally.
Affected (23)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| version < 10.0.14393.8868 | |
| version < 10.0.17763.8389 | |
| version < 10.0.19044.6937 | |
| version < 10.0.19045.6937 | |
| version < 10.0.22631.6649 | |
| version < 10.0.26100.7781 | |
| version < 10.0.26200.7781 | |
| All versions | |
| version < 10.0.14393.8868 | |
| version < 10.0.17763.8389 | |
| version < 10.0.20348.4711 | |
| version < 10.0.25398.2149 | |
| version < 10.0.26100.32313 |
Related CWEs
CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-426
Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
References (1)
Source: secure@microsoft.com
Vendor Advisory
Timeline
No history available yet.