CVE-2026-24290
Published: 10 March 2026
Summary
CVE-2026-24290 is a high-severity Improper Access Control (CWE-284) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-24290 is an improper access control vulnerability in the Windows Projected File System, a component of the Windows operating system. Published on 2026-03-10, it is classified under CWE-284 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction required. Exploitation allows privilege escalation, providing the attacker with high-level access that compromises confidentiality, integrity, and availability of the affected system.
Microsoft's update guide provides details on mitigation, available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24290. Security practitioners should consult this advisory for patching instructions and recommended workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10612
Vulnerability details
Improper access control in Windows Projected File System allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local improper access control vulnerability directly enables exploitation for privilege escalation from low-privileged context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the improper access control flaw in Windows Projected File System by requiring timely application of vendor-provided patches.
Enforces approved authorizations for logical access, directly countering the improper access control that enables local privilege escalation.
Limits the potential impact of privilege escalation by ensuring accounts and processes use the minimum privileges necessary in the affected system.