Cyber Resilience

CVE-2026-24291

HighLPE

Published: 10 March 2026

Published
10 March 2026
Modified
19 March 2026
KEV Added
Patch
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0004 13.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24291 is a high-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 13.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-24291 involves incorrect permission assignment for a critical resource in the Windows Accessibility Infrastructure, specifically the ATBroker.exe component. This vulnerability, published on 2026-03-10, enables local privilege escalation and is rated with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It maps to CWE-732 (Incorrect Permission Assignment for Critical Resource).

A local attacker with low privileges (PR:L) can exploit this issue with low attack complexity and no user interaction. Exploitation requires only local access to the target system, allowing the attacker to elevate privileges and achieve high impacts on confidentiality, integrity, and availability.

The Microsoft Security Response Center advisory provides details on mitigation and patches at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24291. Additional technical context is available in the RegPwn GitHub repository at https://github.com/mdsecactivebreach/RegPwn and the MDSec blog post at https://www.mdsec.co.uk/2026/03/rip-regpwn/.

EU & UK References

Vulnerability details

Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privileges locally.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1546.008 Accessibility Features Privilege Escalation
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features.
Why these techniques?

Direct local privilege escalation via incorrect permissions on ATBroker.exe in the Windows Accessibility Infrastructure, enabling abuse of accessibility features for elevation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-25174Same product: Microsoft Windows 10 1607
CVE-2026-27920Same product: Microsoft Windows 10 1607
CVE-2026-27910Same product: Microsoft Windows 10 1607
CVE-2026-26180Same product: Microsoft Windows 10 1607
CVE-2026-34338Same product: Microsoft Windows 10 1607
CVE-2026-32077Same product: Microsoft Windows 10 1607
CVE-2026-27916Same product: Microsoft Windows 10 1607
CVE-2026-25187Same product: Microsoft Windows 10 1607
CVE-2026-25165Same product: Microsoft Windows 10 1607
CVE-2026-40398Same product: Microsoft Windows 10 1607

Affected Assets

microsoft
windows 10 1607
≤ 10.0.14393.8957 · ≤ 10.0.14393.8957
microsoft
windows 10 1809
≤ 10.0.17763.8511 · ≤ 10.0.17763.8511
microsoft
windows 10 21h2
≤ 10.0.19044.7058 · ≤ 10.0.19044.7058 · ≤ 10.0.19044.7058
microsoft
windows 10 22h2
≤ 10.0.19045.7058 · ≤ 10.0.19045.7058 · ≤ 10.0.19045.7058
microsoft
windows 11 23h2
≤ 10.0.22631.6783 · ≤ 10.0.22631.6783
microsoft
windows 11 24h2
≤ 10.0.26100.7979 · ≤ 10.0.26100.7979
microsoft
windows 11 25h2
≤ 10.0.26200.7979 · ≤ 10.0.26200.7979
microsoft
windows 11 26h1
≤ 10.0.28000.1719 · ≤ 10.0.28000.1719
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
≤ 10.0.14393.8957
+4 more product configuration(s) — see NVD for full list

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Requires timely remediation of the specific flaw in ATBroker.exe permissions to prevent local privilege escalation exploitation.

prevent

Enforces approved access control policies on critical resources, directly countering incorrect permission assignments in Windows Accessibility Infrastructure.

prevent

Establishes secure configuration settings for system components like ATBroker.exe to mitigate risks from misconfigured permissions.

References