|
Information Security Advisory
A recently disclosed Windows Shell vulnerability (CVE‑2026‑21510) allows bypass critical security features by exploiting improper validation in Windows Shell components.
Severity level
CVSS Score: 8.8/high
Description:
CVE‑2026‑21510 is a protection mechanism failure in Microsoft Windows Shell that enables an unauthorized attacker to bypass built‑in security features over a network. The vulnerability arises from improper handling of remotely delivered content within Windows Shell components. By convincing a user to open a malicious link or shortcut (.lnk) file, an attacker can circumvent Windows SmartScreen and other Shell security prompts, allowing attacker‑controlled content to execute without warning or user consent.
Affected Versions:
- Windows 10 versions: 1607, 1809, 21H2, 22H2.
- Windows 11 versions: 23H2, 24H2 and later builds.
- Windows Server: 2012, 2012 R2, 2016, 2019, 2022, and 2022 23H2.
Impact:
Successful exploitation allows attackers to Bypass Windows Shell and SmartScreen security protections.
Resolution:
Please apply the latest patches as part of the February 2026 Security updates.
Reference:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510
https://nvd.nist.gov/vuln/detail/CVE-2026-21510
https://thehackernews.com/2026/02/microsoft-patches-59-vulnerabilities.html
Information Security
Contact
IT Client Services at askIT@yorku.ca or 416 736 5800
|
