CVE-2026-24294
Published: 10 March 2026
Summary
CVE-2026-24294 is a high-severity Improper Authentication (CWE-287) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 12.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the improper authentication flaw in Windows SMB Server through timely identification, reporting, and application of vendor patches.
Limits damage from local privilege escalation by ensuring low-privilege attackers operate with minimal rights insufficient for full system control.
Enforces approved access control policies to block unauthorized privilege elevation via the SMB Server's improper authentication mechanism.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via exploitation of improper authentication in Windows SMB Server service (CWE-287).
NVD Description
Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2026-24294 is an improper authentication vulnerability in the Windows SMB Server, classified under CWE-287. Published on 2026-03-10, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
The vulnerability can be exploited by an authorized local attacker with low privileges. By leveraging the improper authentication mechanism in the SMB Server, such an attacker can elevate their privileges on the affected system, potentially gaining full control over the local machine.
Microsoft's Security Response Center provides an update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24294, which likely details patches and remediation steps. Additionally, Vicarius offers a detection script at https://www.vicarius.io/vsociety/posts/cve-2026-24294-detection-script-improper-authentication-vulnerability-in-windows-smb-server and a mitigation script at https://www.vicarius.io/vsociety/posts/cve-2026-24294-mitigation-script-improper-authentication-vulnerability-in-windows-smb-server to assist in identifying and addressing the issue.
Details
- CWE(s)