CVE-2026-24287
Published: 10 March 2026
Summary
CVE-2026-24287 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 26.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-24287 is a vulnerability classified under CWE-73 (External Control of File Name or Path) within the Windows Kernel. Published on 2026-03-10T18:18:18.683, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue enables an authorized attacker to manipulate file names or paths in the kernel, affecting Windows operating systems.
The attack requires local access with low privileges (PR:L), low attack complexity, and no user interaction. An exploiting attacker can achieve privilege escalation locally, resulting in high impacts to confidentiality, integrity, and availability.
Microsoft's Security Response Center (MSRC) advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24287 provides guidance on patches and mitigations for this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10607
Vulnerability details
External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel path manipulation vulnerability directly enables exploitation for privilege escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely identification, reporting, and patching of the Windows Kernel flaw enabling external control of file name or path for privilege escalation.
Requires implementation of input validation mechanisms at system interfaces, including kernel file path handling, to block manipulation attempts underlying CWE-73.
Enforces least privilege for local users, limiting the scope and impact of privilege escalation achieved via kernel file name or path manipulation.