CVE-2026-24287
Received Received - Intake

Path Traversal in Windows Kernel Enables Local Privilege Escalation

Publication date: 2026-03-10

Last updated on: 2026-03-13

Assigner: Microsoft Corporation

Description
External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-10
Last Modified
2026-03-13
Generated
2026-07-26
AI Q&A
2026-03-10
EPSS Evaluated
2026-07-25
NVD
CVE-2026-24287
EUVD
EUVD-2026-10607

Affected Vendors & Products

Showing 20 associated CPEs
Vendor Product Version / Range
microsoft windows_10_1809 to 10.0.17763.8511 (exc)
microsoft windows_10_1809 to 10.0.17763.8511 (exc)
microsoft windows_10_21h2 to 10.0.19044.7058 (exc)
microsoft windows_10_21h2 to 10.0.19044.7058 (exc)
microsoft windows_10_21h2 to 10.0.19044.7058 (exc)
microsoft windows_10_22h2 to 10.0.19045.7058 (exc)
microsoft windows_10_22h2 to 10.0.19045.7058 (exc)
microsoft windows_10_22h2 to 10.0.19045.7058 (exc)
microsoft windows_11_23h2 to 10.0.22631.6783 (exc)
microsoft windows_11_23h2 to 10.0.22631.6783 (exc)
microsoft windows_11_24h2 to 10.0.26100.7979 (exc)
microsoft windows_11_24h2 to 10.0.26100.7979 (exc)
microsoft windows_11_25h2 to 10.0.26200.7979 (exc)
microsoft windows_11_25h2 to 10.0.26200.7979 (exc)
microsoft windows_11_26h1 to 10.0.28000.1719 (exc)
microsoft windows_11_26h1 to 10.0.28000.1719 (exc)
microsoft windows_server_2019 to 10.0.17763.8511 (exc)
microsoft windows_server_2022 to 10.0.20348.4830 (exc)
microsoft windows_server_2022_23h2 to 10.0.25398.2207 (exc)
microsoft windows_server_2025 to 10.0.26100.32463 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves external control of a file name or path within the Windows Kernel. It allows an authorized attacker to manipulate these elements to elevate their privileges locally on the affected system.

Detection Guidance

I don't know

Impact Analysis

The vulnerability can lead to an elevation of privilege, meaning an attacker with some level of access could gain higher-level permissions. This can compromise the confidentiality, integrity, and availability of the system.

Compliance Impact

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24287. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart