CVE-2026-21240
CVE-2026-21240: 1 tracked advisory record across MS Server. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
MS Server
1 advisory- Advisory severityHigh7.8
High [CVE-2026-21240] Windows HTTP.sys Elevation of Privilege Vulnerability
CVE-2026-21240Source published Source updated
Time-of-check time-of-use (toctou) race condition in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. Affected products named by the advisory: Windows Server 2019; Windows Server 2019 (Server Core installation); Windows Server 2022; Windows Server 2022, 23H2 Edition (Server Core installation); and 2 more. Affected products named by the advisory: Windows Server 2025 (Server Core installation).
- Affected products in this advisory
- Windows Server 2019 (Server Core installation)
- Windows Server 2022, 23H2 Edition (Server Core installation)
- Windows Server 2025 (Server Core installation)
- Source-reported affected versions
- Windows 10 Version 1809 10.0.17763.0 before 10.0.17763.8389
- Windows 10 Version 21H2 10.0.19044.0 before 10.0.19044.6937
- Windows 10 Version 22H2 10.0.19045.0 before 10.0.19045.6937
- Windows 11 version 22H3 10.0.22631.0 before 10.0.22631.6649
8 more entries in the full advisory.
- Source-reported fixed versions
- 10.0.17763.8389
- 10.0.19044.6937
- 10.0.19045.6937
- 10.0.22631.6649
6 more entries in the full advisory.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Android app · Google Play
Monitor future MS Server CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.