Cyber Resilience

CVE-2026-48576

Microsoft Windows 10 21H2 ≤ 10.0.19044.7417

Published
09 June 2026
Modified
09 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 7.9
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
EPSS Score 0.010 61th percentile
Risk Priority 54 floored blend · peak EPSS

Summary

CVE-2026-48576 is a high-severity Reliance on Component That is Not Updateable (CWE-1329) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 39% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-22 (Unsupported System Components) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A03:2025 Software Supply Chain Failures

EU & UK References

Vulnerability Data

No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

CWE(s)
CWE-1329

Related Threats

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1211 Exploitation for Stealth Stealth
Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.
attack.mitre.org →
T1212 Exploitation for Credential Access Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-48573Same product: Microsoft Windows 10 1607
CVE-2026-21265Same product: Microsoft Windows 10 1607
CVE-2026-41097Same product: Microsoft Windows 10 1809
CVE-2025-21229Same product: Microsoft Windows 10 1607
CVE-2025-21257Same product: Microsoft Windows 10 1607
CVE-2025-21261Same product: Microsoft Windows 10 1607
CVE-2025-21249Same product: Microsoft Windows 10 1607
CVE-2025-21256Same product: Microsoft Windows 10 1607
CVE-2025-21258Same product: Microsoft Windows 10 1607
CVE-2025-21215Same product: Microsoft Windows 10 1607

Affected Assets

microsoft
windows 10 1607
≤ 10.0.14393.9234 · ≤ 10.0.14393.9234
microsoft
windows 10 1809
≤ 10.0.17763.8880 · ≤ 10.0.17763.8880
microsoft
windows 10 21h2
≤ 10.0.19044.7417 · ≤ 10.0.19044.7417 · ≤ 10.0.19044.7417
microsoft
windows 10 22h2
≤ 10.0.19045.7417 · ≤ 10.0.19045.7417 · ≤ 10.0.19045.7417
microsoft
windows 11 23h2
≤ 10.0.22631.7219 · ≤ 10.0.22631.7219
microsoft
windows 11 24h2
≤ 10.0.26100.8655 · ≤ 10.0.26100.8655
microsoft
windows 11 25h2
≤ 10.0.26200.8655 · ≤ 10.0.26200.8655
microsoft
windows 11 26h1
≤ 10.0.28000.2269 · ≤ 10.0.28000.2269
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
≤ 10.0.14393.9234
+3 more product configuration(s) — see NVD for full list

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-22 Unsupported System Components good match

Replacing components when vendor support ends directly stops reliance on non-updateable parts that cannot receive patches.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-02 full match
prevents

Directly addresses replacing or removing software that cannot be maintained via updates or patches.

PR.PS-03 full match
prevents

Directly addresses replacing hardware components that lack needed security capabilities or cannot be updated.

ID.AM-08 mostly match
prevents

Lifecycle management explicitly requires planning for updates or replacement of components that cannot be patched.

GV.SC-07 partial match
prevents

Supplier risk assessment can identify non-updateable components before acquisition but does not prevent their use inside the product.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.20 Addressing information security within supplier agreements mostly match
mitigates

Supplier agreements can stipulate patchability or end-of-life support, yet the weakness is rooted in product architecture rather than contractual clauses.

A.5.21 Managing information security in the ICT supply chain mostly match
mitigates

ICT supply-chain management can influence component selection toward maintainable ones, but does not guarantee technical updateability.

A.5.19 Information security in supplier relationships partial match
mitigates

Supplier-relationship controls can require vendors to provide updateable components, but do not directly mandate component design.

A.8.25 Secure development life cycle partial match
mitigates

Secure-SDLC practices encourage selection of maintainable components, but the weakness may still arise from third-party or legacy choices.

A.8.32 Change management partial match
mitigates

Change-management processes can plan for component replacement, yet cannot eliminate the inherent non-updateability of an already-deployed component.

A.8.8 Management of technical vulnerabilities partial match
finds

Vulnerability-management processes can detect and drive replacement of non-updateable components, but cannot retroactively make them patchable.

References