CVE-2021-26866: Microsoft Windows Update Agent Directory Junction Denial-of-Service Vulnerability
First published: Tue Mar 09 2021(Updated: )
Windows Update Service Elevation of Privilege Vulnerability
Credit: secure@microsoft.com secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| =20H2 | ||
| =20H2 | ||
| =20H2 | ||
| =20H2 | ||
| =1803 | ||
| =1809 | ||
| =1809 | ||
| =1809 | ||
| =1607 | ||
| =1607 | ||
| =1909 | ||
| =1909 | ||
| =1909 | ||
| =1909 | ||
| =1803 | ||
| =1803 | ||
| =2004 | ||
| =2004 | ||
| =2004 | ||
| =2004 | ||
| Microsoft Windows 10 | ||
| Microsoft Windows 10 | =20h2 | |
| Microsoft Windows 10 | =1607 | |
| Microsoft Windows 10 | =1803 | |
| Microsoft Windows 10 | =1809 | |
| Microsoft Windows 10 | =1909 | |
| Microsoft Windows 10 | =2004 | |
| Microsoft Windows Server 2016 | ||
| Microsoft Windows Server 2016 | =20h2 | |
| Microsoft Windows Server 2016 | =1909 | |
| Microsoft Windows Server 2016 | =2004 | |
| Microsoft Windows Server 2019 | ||
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-26866?
CVE-2021-26866 is a vulnerability that allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows.
How does CVE-2021-26866 work?
The vulnerability is caused by a flaw within the Windows Update Agent that can be exploited by executing low-privileged code on the target system.
What is the severity of CVE-2021-26866?
CVE-2021-26866 has a high severity rating with a severity value of 7.1.
Which versions of Windows are affected by CVE-2021-26866?
Microsoft Windows Server 2019, Windows 10 (version 1809), Windows 10 (version 1909), Windows 10 (version 1803), Windows 10 (version 1607), Windows Server 2016, and Windows 10 (version 2004) are affected by CVE-2021-26866.
How can I fix CVE-2021-26866?
To fix CVE-2021-26866, apply the relevant patch provided by Microsoft, which can be found in the associated URLs.
- agent/type
- agent/first-publish-date
- collector/msrc-cve
- source/Microsoft
- agent/author
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-21-286
- alias/ZDI-CAN-12442
- alias/CVE-2021-26866
- agent/software-canonical-lookup
- agent/title
- agent/remedy
- agent/references
- agent/weakness
- agent/severity
- agent/softwarecombine
- agent/description
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- agent/trending
- vendor/microsoft
- canonical/microsoft windows
- canonical/microsoft windows 10
- version/microsoft windows 10/1803
- version/microsoft windows 10/1909
- version/microsoft windows 10/2004
- version/microsoft windows 10/1809
- canonical/microsoft windows server
- version/microsoft windows server/2004
- version/microsoft windows 10/1607
- version/microsoft windows server/20h2
- canonical/microsoft windows server 2019
- version/microsoft windows server/1909
- version/microsoft windows 10/20h2
- canonical/microsoft windows server 2016
- version/microsoft windows server 2016/20h2
- version/microsoft windows server 2016/1909
- version/microsoft windows server 2016/2004