CVE-2026-21508CWE-287CWE-426

Windows Storage Elevation of Privilege Vulnerability

High · published February 10, 2026

CVSS v3.1
7.0
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

⚡ A local attacker could trick Windows Storage into granting them higher privileges. Talk about a security faux pas! 🚨 Think of it like an employee sneaking into a restricted area of a building, bypassing the security checks. They shouldn't have access, but a small oversight allows them to waltz right in and potentially cause chaos. If an attacker successfully exploits this vulnerability, they could gain elevated privileges, allowing them to access sensitive data, modify system settings, or even install malicious software. This could lead to a significant compromise of the system's integrity and security.

Put simply

Think of it like an employee sneaking into a restricted area of a building, bypassing the security checks. They shouldn't have access, but a small oversight allows them to waltz right in and potentially cause chaos. This vulnerability stems from improper authentication mechanisms in Windows Storage, enabling an authorized user to elevate their privileges locally, bypassing intended security restrictions.

What to do

If an attacker successfully exploits this vulnerability, they could gain elevated privileges, allowing them to access sensitive data, modify system settings, or even install malicious software. This could lead to a significant compromise of the system's integrity and security. To mitigate this risk, ensure your Windows environment is updated with the latest security patches. Regularly review access controls and user permissions to tighten security. It's also a good idea to monitor logs for any unauthorized access attempts. You've got this! Patch your systems, and you'll be one step closer to being a security hero! 🦸‍♂️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00451 · 38.2th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-426 · Untrusted Search Path
Published
2026-02-10T17:51Z
EPSS history
Timeline
  • 10 FEB 17:51Z
    Windows Storage Elevation of Privilege Vulnerability
    cvelistv5