CVE-2021-24092

CVE Enrichment

CVSS: 7.8 HIGH
EPSS: 0.61%
EPSS Percentile: 48.64%
CISA KEV: Not listed

Description

Microsoft Defender Elevation of Privilege Vulnerability

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 26-Feb-2021 06:15
Last Modified: 17-Jun-2026 10:39
EPSS Date: 2026-10-23
CWE: CWE-269

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

microsoft / windows_defender Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:windows_defender:-:*:*:*:*:*:*:*
microsoft / endpoint_protection Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:endpoint_protection:-:*:*:*:*:*:*:*
microsoft / security_essentials Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:security_essentials:-:*:*:*:*:*:*:*
microsoft / system_center_endpoint_protection Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:system_center_endpoint_protection:-:*:*:*:*:*:*:*
microsoft / system_center_endpoint_protection Source: NVD CPE · affected
Version / affected range: 2012
cpe:2.3:a:microsoft:system_center_endpoint_protection:2012:-:*:*:*:*:*:*
microsoft / system_center_endpoint_protection Source: NVD CPE · affected
Version / affected range: 2012
cpe:2.3:a:microsoft:system_center_endpoint_protection:2012:r2:*:*:*:*:*:*

References

af854a3a-2127-422b-91ae-364da2661108

Last enrichment sync: 02-Nov-2026 11:19
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

In February 2021, SentinelLabs researcher Kasif Dekel disclosed CVE-2021-24092, a privilege escalation vulnerability that allowed a local non-administrator to overwrite arbitrary files by placing a hard link at the Researchers Show How Microsoft Defender’s BTR.sys Driver Can Remove Security Software at Boot

People (2)

MITRE ATT&CK (3)

Vendors (1)

Products (2)

Tools (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.