CVE-2026-26128
Published: 10 March 2026
Summary
CVE-2026-26128 is a high-severity Improper Authentication (CWE-287) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 22.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-26128 is an improper authentication vulnerability (CWE-287) in the Windows SMB Server. Published on 2026-03-10, it enables an authorized attacker to elevate privileges locally, with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The attack requires local access with low privileges (PR:L), low attack complexity (AC:L), and no user interaction (UI:N). Exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), specifically through local privilege escalation on the affected system.
Mitigation details are available in the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26128.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10692
Vulnerability details
Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper authentication vulnerability in Windows SMB Server directly enables local privilege escalation from low to high privileges via exploitation of a software flaw (CWE-287).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the improper authentication flaw in Windows SMB Server through timely identification, reporting, and correction of vulnerabilities like CVE-2026-26128.
Enforces least privilege to limit the scope and impact of local privilege escalation enabled by the authentication vulnerability.
Requires robust identification and authentication for organizational users, countering the improper authentication mechanism in Windows SMB Server.