Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Windows Kernel: Unauthorized File Access Can Elevate Privileges

CVE-2026-24287 · published 7 months ago
Summary

A security issue affects Windows systems, allowing an authorized user to gain more access to the system than they should. This could lead to unauthorized changes to system settings or data. To protect your system, ensure you have the latest Windows updates installed.

What to do
  • Update microsoft windows_10_1809 to version 10.0.17763.8511 or later.
  • Update microsoft windows_10_21h2 to version 10.0.19044.7058 or later.
  • Update microsoft windows_10_22h2 to version 10.0.19045.7058 or later.
  • Update microsoft windows_11_23h2 to version 10.0.22631.6783 or later.
  • Update microsoft windows_11_24h2 to version 10.0.26100.7979 or later.
  • Update microsoft windows_11_25h2 to version 10.0.26200.7979 or later.
  • Update microsoft windows_11_26h1 to version 10.0.28000.1719 or later.
  • Update microsoft windows_server_2019 to version 10.0.17763.8511 or later.
  • Update microsoft windows_server_2022 to version 10.0.20348.4830 or later.
  • Update microsoft windows_server_2022_23h2 to version 10.0.25398.2207 or later.
  • Update microsoft windows_server_2025 to version 10.0.26100.32463 or later.
Affected software
VendorProductAffected versions
microsoft windows_10_1809 < 10.0.17763.8511
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
microsoft windows_10_21h2 < 10.0.19044.7058
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*
microsoft windows_10_22h2 < 10.0.19045.7058
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*
microsoft windows_11_23h2 < 10.0.22631.6783
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*
microsoft windows_11_24h2 < 10.0.26100.7979
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*
microsoft windows_11_25h2 < 10.0.26200.7979
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*
microsoft windows_11_26h1 < 10.0.28000.1719
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*
microsoft windows_server_2019 < 10.0.17763.8511
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
microsoft windows_server_2022 < 10.0.20348.4830
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
microsoft windows_server_2022_23h2 < 10.0.25398.2207
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
microsoft windows_server_2025 < 10.0.26100.32463
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*
Original advisory text
External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally.
External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-73External Control of File Name or Path
Timeline
Published10 Mar 2026
Updated4 Nov 2026
First seen11 Mar 2026
Sources
CVE-2026-24287 · NVD
Track software like this
Free during beta