CVE-2026-25187
Published: 10 March 2026
Summary
CVE-2026-25187 is a high-severity Link Following (CWE-59) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 16.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-25 (Reference Monitor).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the improper link resolution vulnerability in Winlogon through timely identification, reporting, and patching of the specific flaw.
Implements a reference monitor that mediates all file access subject to access control, addressing failures in symbolic link resolution enforcement.
Enforces least privilege on accounts and processes to limit the scope and impact of privilege escalation via symlink manipulation in Winlogon.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes a local privilege escalation vulnerability in Winlogon exploitable via symbolic link manipulation (CWE-59), directly matching T1068 Exploitation for Privilege Escalation.
NVD Description
Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2026-25187 is an improper link resolution before file access vulnerability, commonly known as "link following," affecting the Winlogon component in Windows. Published on 2026-03-10T18:18:35.413, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-59: Improper Link Resolution Before File Access.
The vulnerability enables a local attacker with low privileges to exploit Winlogon by manipulating symbolic links during file access operations, resulting in privilege escalation. Exploitation requires only local access, low attack complexity, and no user interaction, allowing the attacker to gain high-impact confidentiality, integrity, and availability effects.
Microsoft's Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25187 provides guidance on patches and mitigation steps.
Details
- CWE(s)