CVE · Exploited · On CISA KEV

CVE-2026-21510

Microsoft Windows Shell Protection Mechanism Failure Vulnerability

8.8: CVSS 3.1
2: stories
FEB 10: added to KEV

Severity: 8.8 High · vendor score
Vendor: Microsoft
Product: Windows
Published: Feb 10, 2026
Added to KEV: Feb 10, 2026
KEV deadline: Mar 3, 2026
Ransomware use: Unknown
Weakness: CWE-693

What it is

Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 2 stories

Newest first ↑

FEB 11
VulnerabilitiesMicrosoft Fixes Six Exploited Bugs in February Patch Tuesday UpdatesThe exploited vulnerabilities in question exist across various products, from Microsoft Word to Windows Shell.DECIPHER · 3 MIN
APR 29
VulnerabilitiesWindows CVE-2026-32202 Exploited in the WildThe current exploits are targeting CVE-2026-32202, a bug in the Windows Shell that allows an attacker to gain access to some sensitive data on the target network.DENNIS FISHER · 2 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorymsrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510