What is the severity of CVE-2021-26431?

CVE-2021-26431 is classified as a medium severity vulnerability that allows an elevation of privilege in the Windows Recovery Environment.

How do I fix CVE-2021-26431?

To fix CVE-2021-26431, install the latest security updates provided by Microsoft for affected Windows versions.

Which versions of Windows are affected by CVE-2021-26431?

CVE-2021-26431 affects Windows 10 and Windows Server versions 2004, 20H2, and 21H1.

Can CVE-2021-26431 be exploited remotely?

CVE-2021-26431 cannot be exploited remotely; an attacker must have physical access to the affected system.

What are the potential impacts of CVE-2021-26431?

Exploitation of CVE-2021-26431 could allow an attacker to gain elevated privileges and execute arbitrary code with higher permissions.

Vulnerability/
CVE-2021-26431

high

7.8

10/8/2021

12/8/2021

16/1/2024

3/8/2024

CVE-2021-26431: Microsoft Windows Lock Screen Improper Access Control Authentication Bypass Vulnerability

First published: Tue Aug 10 2021(Updated: )

Windows Recovery Environment Agent Elevation of Privilege Vulnerability

Credit: secure@microsoft.com secure@microsoft.com

Affected Software	Affected Version	How to fix
	=20H2	fix available externally
	=20H2	fix available externally
	=20H2	fix available externally
	=20H2	fix available externally
	=21H1	fix available externally
	=21H1	fix available externally
	=21H1	fix available externally
	=2004	fix available externally
	=2004	fix available externally
	=2004	fix available externally
	=2004	fix available externally
	=20h2
	=21h1
	=2004
	=20h2
	=2004
Microsoft Windows 10	=20h2
Microsoft Windows 10	=21h1
Microsoft Windows 10	=2004
Microsoft Windows Server 2016	=20h2
Microsoft Windows Server 2016	=2004

Remedy

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26431

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2021-26431?
CVE-2021-26431 is classified as a medium severity vulnerability that allows an elevation of privilege in the Windows Recovery Environment.
How do I fix CVE-2021-26431?
To fix CVE-2021-26431, install the latest security updates provided by Microsoft for affected Windows versions.
Which versions of Windows are affected by CVE-2021-26431?
CVE-2021-26431 affects Windows 10 and Windows Server versions 2004, 20H2, and 21H1.
Can CVE-2021-26431 be exploited remotely?
CVE-2021-26431 cannot be exploited remotely; an attacker must have physical access to the affected system.
What are the potential impacts of CVE-2021-26431?
Exploitation of CVE-2021-26431 could allow an attacker to gain elevated privileges and execute arbitrary code with higher permissions.

agent/type
agent/first-publish-date
collector/msrc-cve
source/Microsoft
agent/author
agent/softwarecombine
agent/remedy
agent/title
agent/references
agent/severity
agent/description
collector/zdi-advisory
source/ZDI
alias/ZDI-21-1053
alias/ZDI-CAN-13692
alias/CVE-2021-26431
agent/software-canonical-lookup
collector/nvd-api
source/NVD
agent/software-canonical-lookup-request
collector/nvd-index
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/event
agent/trending
agent/tags
agent/source
vendor/microsoft
canonical/microsoft windows
canonical/microsoft windows server
version/microsoft windows server/20h2
canonical/microsoft windows 10
version/microsoft windows 10/20h2
version/microsoft windows server/2004
version/microsoft windows 10/21h1
version/microsoft windows 10/2004
canonical/microsoft windows server 2016
version/microsoft windows server 2016/20h2
version/microsoft windows server 2016/2004

Frequently Asked Questions

What is the severity of CVE-2021-26431?
CVE-2021-26431 is classified as a medium severity vulnerability that allows an elevation of privilege in the Windows Recovery Environment.
How do I fix CVE-2021-26431?
To fix CVE-2021-26431, install the latest security updates provided by Microsoft for affected Windows versions.
Which versions of Windows are affected by CVE-2021-26431?
CVE-2021-26431 affects Windows 10 and Windows Server versions 2004, 20H2, and 21H1.
Can CVE-2021-26431 be exploited remotely?
CVE-2021-26431 cannot be exploited remotely; an attacker must have physical access to the affected system.
What are the potential impacts of CVE-2021-26431?
Exploitation of CVE-2021-26431 could allow an attacker to gain elevated privileges and execute arbitrary code with higher permissions.

CVE-2021-26431: Microsoft Windows Lock Screen Improper Access Control Authentication Bypass Vulnerability

Remedy

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2021-26431?

How do I fix CVE-2021-26431?

Which versions of Windows are affected by CVE-2021-26431?

Can CVE-2021-26431 be exploited remotely?

What are the potential impacts of CVE-2021-26431?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2021-26431?

How do I fix CVE-2021-26431?

Which versions of Windows are affected by CVE-2021-26431?

Can CVE-2021-26431 be exploited remotely?

What are the potential impacts of CVE-2021-26431?