CVE-2026-21510

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 61.24%
EPSS Percentile: 99.16%
CISA KEV: YES — Known Exploited Vulnerability

Description

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 11-Feb-2026 01:16
Last Modified: 17-Jun-2026 17:18
EPSS Date: 2026-11-01
CWE: CWE-693

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2026-02-10
Remediation Due: 2026-03-03
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21510

Affected Products / Versions

microsoft / windows_10_1607 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.14393.8868
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
microsoft / windows_10_1607 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.14393.8868
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
microsoft / windows_10_1809 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.17763.8389
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
microsoft / windows_10_1809 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.17763.8389
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
microsoft / windows_10_21h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19044.6937
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*
microsoft / windows_10_21h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19044.6937
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*
microsoft / windows_10_21h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19044.6937
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*
microsoft / windows_10_22h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19045.6937
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*
microsoft / windows_10_22h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19045.6937
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*
microsoft / windows_10_22h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19045.6937
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*
microsoft / windows_11_23h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.22631.6649
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*
microsoft / windows_11_23h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.22631.6649
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*
microsoft / windows_11_24h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26100.7781
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*
microsoft / windows_11_24h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26100.7781
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*
microsoft / windows_11_25h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26200.7781
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*
microsoft / windows_11_25h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26200.7781
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*
microsoft / windows_server_2012 Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
microsoft / windows_server_2012 Source: NVD CPE · affected
Version / affected range: r2
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
microsoft / windows_server_2016 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.14393.8868
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
microsoft / windows_server_2019 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.17763.8389
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
microsoft / windows_server_2022 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.20348.4711
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
microsoft / windows_server_2022_23h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.25398.2149
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
microsoft / windows_server_2025 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26100.32313
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*

References

Last enrichment sync: 02-Nov-2026 20:01
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

The report highlights active abuse of CVE-2026-21509, CVE-2026-21510, CVE-2026-32202, and several perimeter CVEs by actors including TA422 (APT28), TA406 (Opal Sleet), and TA569 (SocGholish). Proofpoint Observes 12 2026 CVEs in Exploitation, Four Not on CISA KEV
CISA has ordered federal agencies to patch Windows endpoints and servers for a zero-click vulnerability tracked as CVE-2026-32202 that Akamai said remained after an incomplete Microsoft fix for CVE-2026-21510. CISA Orders Federal Agencies to Patch Exploited Windows Flaw CVE-2026-32202
The vulnerability resulted from an incomplete fix for CVE-2026-21510 and is related to CVE-2026-21513 exploited by APT28. CISA and Microsoft Confirm Active Exploitation of Windows Shell Flaw CVE-2026-32202
The initial vulnerability, tracked as CVE-2026-21510 and patched in February, could be exploited for remote code execution (RCE) if the attacker could convince the victim to open a malicious shortcut file. Akamai Finds Windows Patch Flaw Enabling Zero-Click NTLM Credential Theft

CVE (8)

Malware (2)

People (1)

Threat Actors (8)

MITRE ATT&CK (10)

Vendors (6)

Products (14)

Industries (4)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.