Executive brief
A security flaw in the Windows SMB Server component could allow a user who already has limited access to a computer to gain full administrative control. SMB is a standard Windows service used for sharing files and printers across a network. If exploited, an attacker could bypass security restrictions to access sensitive data, install software, or disrupt business operations.
Technical details
An improper authentication vulnerability (CWE-287) exists in the Windows SMB Server. The flaw allows a locally authenticated attacker with low privileges to bypass authentication checks and elevate their privileges to a higher level, potentially gaining full system access. The attack vector is local, meaning the attacker must already have the ability to execute code on the target system. Microsoft has released security updates to address this issue across various versions of Windows 10 and Windows 11. Proof-of-concept code has been reported to exist, though active exploitation in the wild was not confirmed at the time of publication.
Affected products
- Microsoft Windows 10 Version 1607 10.0.14393.0 to 10.0.14393.8957
- Microsoft Windows 10 Version 1809 10.0.17763.0 to 10.0.17763.8511
- Microsoft Windows 10 Version 21H2 10.0.19044.0 to 10.0.19044.7058
- Microsoft Windows 10 Version 22H2 10.0.19045.0 to 10.0.19045.7058
- Microsoft Windows 11 Version 22H2/23H2 10.0.22631.0 to 10.0.22631.6783
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.8037
Timeline
- 2026-03-10: disclosed
- 2026-03-10: advisory: Microsoft released vendor advisory
- 2026-06-30: other: CISA-ADP updated record to reflect PoC availability
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24294
- https://www.vicarius.io/vsociety/posts/cve-2026-24294-detection-script-improper-authentication-vulnerability-in-windows-smb-server
- https://www.vicarius.io/vsociety/posts/cve-2026-24294-mitigation-script-improper-authentication-vulnerability-in-windows-smb-server
- https://github.com/0xNDI/CVE-2026-24294