Cyber Resilience

CVE-2026-41097

Microsoft Windows 10 21H2 ≤ 10.0.19044.7291

Published
12 May 2026
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 6.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.014 70th percentile
Risk Priority 52 floored blend · peak EPSS

Summary

CVE-2026-41097 is a medium-severity Reliance on Component That is Not Updateable (CWE-1329) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 6.7 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 30% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-22 (Unsupported System Components) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A03:2025 Software Supply Chain Failures

EU & UK References

Vulnerability Data

Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

CWE(s)
CWE-1329

Related Threats

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1211 Exploitation for Stealth Stealth
Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.
attack.mitre.org →
T1212 Exploitation for Credential Access Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-21265Same product: Microsoft Windows 10 1809
CVE-2026-48576Same product: Microsoft Windows 10 1809
CVE-2026-48573Same product: Microsoft Windows 10 1809
CVE-2024-49077Same product: Microsoft Windows 10 1809
CVE-2024-43629Same product: Microsoft Windows 10 1809
CVE-2024-43624Same product: Microsoft Windows 10 1809
CVE-2024-49098Same product: Microsoft Windows 10 1809
CVE-2024-49078Same product: Microsoft Windows 10 1809
CVE-2024-49083Same product: Microsoft Windows 10 1809
CVE-2024-49101Same product: Microsoft Windows 10 1809

Affected Assets

microsoft
windows 10 1809
≤ 10.0.17763.8755 · ≤ 10.0.17763.8755
microsoft
windows 10 21h2
≤ 10.0.19044.7291 · ≤ 10.0.19044.7291 · ≤ 10.0.19044.7291
microsoft
windows 10 22h2
≤ 10.0.19045.7291 · ≤ 10.0.19045.7291 · ≤ 10.0.19045.7291
microsoft
windows 11 23h2
≤ 10.0.22631.7079 · ≤ 10.0.22631.7079
microsoft
windows 11 24h2
≤ 10.0.26100.8390 · ≤ 10.0.26100.8390
microsoft
windows 11 25h2
≤ 10.0.26200.8390 · ≤ 10.0.26200.8390
microsoft
windows 11 26h1
≤ 10.0.28000.2113 · ≤ 10.0.28000.2113
microsoft
windows server 2019
≤ 10.0.17763.8755
microsoft
windows server 2022
≤ 10.0.20348.5074
microsoft
windows server 2022 23h2
≤ 10.0.25398.2330
+1 more product configuration(s) — see NVD for full list

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-22 Unsupported System Components good match

Replacing components when vendor support ends directly stops reliance on non-updateable parts that cannot receive patches.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-02 full match
prevents

Directly addresses replacing or removing software that cannot be maintained via updates or patches.

PR.PS-03 full match
prevents

Directly addresses replacing hardware components that lack needed security capabilities or cannot be updated.

ID.AM-08 mostly match
prevents

Lifecycle management explicitly requires planning for updates or replacement of components that cannot be patched.

GV.SC-07 partial match
prevents

Supplier risk assessment can identify non-updateable components before acquisition but does not prevent their use inside the product.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.20 Addressing information security within supplier agreements mostly match
mitigates

Supplier agreements can stipulate patchability or end-of-life support, yet the weakness is rooted in product architecture rather than contractual clauses.

A.5.21 Managing information security in the ICT supply chain mostly match
mitigates

ICT supply-chain management can influence component selection toward maintainable ones, but does not guarantee technical updateability.

A.5.19 Information security in supplier relationships partial match
mitigates

Supplier-relationship controls can require vendors to provide updateable components, but do not directly mandate component design.

A.8.25 Secure development life cycle partial match
mitigates

Secure-SDLC practices encourage selection of maintainable components, but the weakness may still arise from third-party or legacy choices.

A.8.32 Change management partial match
mitigates

Change-management processes can plan for component replacement, yet cannot eliminate the inherent non-updateability of an already-deployed component.

A.8.8 Management of technical vulnerabilities partial match
finds

Vulnerability-management processes can detect and drive replacement of non-updateable components, but cannot retroactively make them patchable.

References