What is the CVSS score of CVE-2026-21250?

CVE-2026-21250 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2026-21250?

A high-severity vulnerability in Windows HTTP.sys enables authenticated attackers to gain elevated system privileges on affected servers.. A patch is available.

Is there a public PoC exploit available for CVE-2026-21250?

Yes, a public proof-of-concept exploit is available for CVE-2026-21250. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-21250?

Within 24 hours: Inventory all Windows servers running HTTP.sys and assess exposure in production environments; begin daily monitoring for exploitation attempts. Within 7 days: Implement network segmentation to restrict HTTP.sys service access and limit lateral movement; enforce strict access controls on authenticated accounts. Within 30 days: Deploy compensating controls listed below; establish vendor contact for patch notification; conduct security awareness training on credential protection.

Windows CVE-2026-21250

HIGH

Untrusted Pointer Dereference (CWE-822)

2026-02-10 secure@microsoft.com

Windows Microsoft Windows 11 24h2 Windows 11 25h2 Windows Server 2022 23h2 Windows Server 2025

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

HIGH 7.8

DescriptionCVE.org

Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

AnalysisAI

Windows HTTP.sys contains an unsafe pointer dereference vulnerability that enables authenticated local attackers to escalate privileges on affected systems including Windows 11, Windows Server 2025, and related versions. An attacker with local user access can exploit this flaw to gain system-level privileges with high confidence in successful exploitation. No patch is currently available for this vulnerability.

Technical ContextAI

Affects Windows 11 24H2. Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

RemediationAI

Monitor vendor advisories for a patch.

More in Windows

View all

CVE-2019-0803 HIGH Act Now POC

7.8 Apr 09

Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in

CVE-2020-1472 MEDIUM Act Now POC

5.5 Aug 17

A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr

CVE-2025-33053 HIGH Act Now POC

8.8 Jun 10

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables

CVE-2025-33073 HIGH Act Now POC

8.8 Jun 10

Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker

CVE-2025-13315 CRITICAL Emergency POC

9.3 Nov 19

Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b

CVE-2013-10047 CRITICAL Emergency POC

9.3 Aug 01

An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote

CVE-2012-10030 CRITICAL Emergency POC

9.3 Aug 05

FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit

CVE-2025-34101 CRITICAL Emergency POC

9.3 Jul 10

Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio

CVE-2025-13316 HIGH Act Now POC

8.2 Nov 19

Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred

CVE-2025-34095 CRITICAL Emergency POC

9.3 Jul 10

Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/

CVE-2025-11953 CRITICAL Act Now POC

9.8 Nov 03

React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo

CVE-2025-24054 MEDIUM This Month POC

6.5 Mar 11

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network

Same weakness CWE-822 – Untrusted Pointer Dereference

View all

CVE-2024-21338 HIGH POC

7.8

CVE-2024-35250 HIGH POC

7.8

CVE-2023-21768 HIGH POC

7.8

CVE-2025-50165 CRITICAL

9.8

CVE-2026-33120 HIGH

8.8

CVE-2023-1437 CRITICAL

9.8

CVE-2018-17893 CRITICAL

9.8

CVE-2018-14811 CRITICAL

9.8

CVE-2026-21250 vulnerability details – vuln.today

Back

Windows CVE-2026-21250

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Windows

Same weakness CWE-822 – Untrusted Pointer Dereference

Share

External POC / Exploit Code