Raw vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-21508 is a high-severity Improper Authentication (CWE-287) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Abuse Elevation Control Mechanism (T1548); ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7332
Vulnerability Data
Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local privilege escalation via improper authentication (CWE-287) directly enables abuse of elevation control mechanisms on Windows.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authentication checks before allowing access to Windows Storage functions, blocking the improper-authentication path to local privilege escalation.
Requires unique identification and authentication of users before granting elevated Storage privileges, directly addressing the CWE-287 weakness.
Limits the set of privileges that can be obtained even if the authentication flaw is exploited, reducing the impact of the local elevation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Preventing execution of unauthorized code directly blocks the malicious binaries that an untrusted search path would load.
PR.AA-03 directly enforces authentication mechanisms that eliminate most improper-authentication defects, yet CWE-287 spans additional vectors (missing checks, flawed protocols, session handling) that one control does not fully close.
PR.AA-04 directly enables verification of identity assertions (mostly preventing CWE-287 in that scope) yet leaves many other authentication failure modes unaddressed (only partial prevention overall).
Secure development practices include avoiding or sanitizing externally influenced search paths in application code.
PR.AA-01 supplies and governs credentials/tokens that authentication relies on, removing some weak-credential cases, yet leaves verification logic, missing checks, and protocol flaws untouched.
PR.AA-02 ensures valid enrollment and unique credential binding, which reduces some improper-auth risks at issuance time but leaves runtime claim verification untouched, so each direction only partially addresses the other.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring authentication methods whose strength matches the sensitivity of the data and mandating multi-factor authentication directly blocks attempts to access resources without proving identity.
Verifying user identity before issuing replacement credentials and forcing changes after compromise reduces the likelihood that authentication bypass can be achieved through stolen or weak credentials.
Security testing can discover search-path issues but does not itself prevent them in production code.
Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.
Restricting software installation reduces the chance that untrusted binaries or libraries are placed in search paths.
Requiring authentication mechanisms and technical parameters for secure connections ensures that network services verify user identity before granting access, preventing exploitation of missing or weak authentication.