CVE-2026-21510

8.8

HIGH CVSS 3.1

Microsoft Windows Shell Protection Mechanism Failure Vulnerability - [Actively Exploited]

Description

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

INFO

Published Date :

Feb. 10, 2026, 6:16 p.m.

Last Modified :

Feb. 11, 2026, 4:13 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Mar 03, 2026

Alert Date: Feb 10, 2026 | 20 days ago

Description :

Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known Ransomware Campaign Use:

Unknown

Notes :

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21510

Affected Products

The following products are affected by CVE-2026-21510 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Microsoft	windows_server_2012
2	Microsoft	windows_server_2016
3	Microsoft	windows_server_2019
4	Microsoft	windows_10_1607
5	Microsoft	windows_10_1809
6	Microsoft	windows_10_21h2
7	Microsoft	windows_10_22h2
8	Microsoft	windows_server_2022
9	Microsoft	windows_11_23h2
10	Microsoft	windows_server_2022_23h2
11	Microsoft	windows_server_23h2
12	Microsoft	windows_server_2012_r2
13	Microsoft	windows_11_24h2
14	Microsoft	windows_server_2025
15	Microsoft	windows_11_25h2
16	Microsoft	windows_11_26h1

: Total Affected Vendor : 1 | Products : 16

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				[email protected]

Solution

Address Windows Shell protection bypass by applying security updates and hardening configurations.

Install the latest security updates for Windows.
Review and harden Windows Shell configurations.
Implement network access controls.
Monitor for suspicious network activity.

Public PoC/Exploit Available at Github

CVE-2026-21510 has a 7 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-21510.

URL	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21510	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-21510 is associated with the following CWEs:

CWE-693: Protection Mechanism Failure

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-21510 weaknesses.

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs Accessing Functionality Not Properly Constrained by ACLs CAPEC-17: Using Malicious Files Using Malicious Files CAPEC-20: Encryption Brute Forcing Encryption Brute Forcing CAPEC-22: Exploiting Trust in Client Exploiting Trust in Client CAPEC-36: Using Unpublished Interfaces or Functionality Using Unpublished Interfaces or Functionality CAPEC-51: Poison Web Service Registry Poison Web Service Registry CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data Utilizing REST's Trust in the System Resource to Obtain Sensitive Data CAPEC-59: Session Credential Falsification through Prediction Session Credential Falsification through Prediction CAPEC-65: Sniff Application Code Sniff Application Code CAPEC-74: Manipulating State Manipulating State CAPEC-87: Forceful Browsing Forceful Browsing CAPEC-107: Cross Site Tracing Cross Site Tracing CAPEC-127: Directory Indexing Directory Indexing CAPEC-237: Escaping a Sandbox by Calling Code in Another Language Escaping a Sandbox by Calling Code in Another Language CAPEC-477: Signature Spoofing by Mixing Signed and Unsigned Content Signature Spoofing by Mixing Signed and Unsigned Content CAPEC-480: Escaping Virtualization Escaping Virtualization CAPEC-668: Key Negotiation of Bluetooth Attack (KNOB) Key Negotiation of Bluetooth Attack (KNOB)

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

kapetanios55/SentinelCBContent

None

Shell Python

Updated: 4 days, 15 hours ago

0 stars 0 fork 0 watcher

Born at : Feb. 20, 2026, 10:40 p.m. This repo has been linked 23 different CVEs too.

greenido/CISA-alerts-bot

A stateless GitHub Action that monitors Cybersecurity Alerts and sends structured alerts to Slack / Telegram

TypeScript

Updated: 2 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 13, 2026, 4:10 a.m. This repo has been linked 6 different CVEs too.

andreassudo/CVE-2026-21510-CVSS-8.8-Important-Windows-Shell-security-feature-bypass

CVE-2026-21510 (CVSS 8.8, Important) — Windows Shell security feature bypass. An attacker can trick a user into clicking a malicious link or shortcut file to bypass SmartScreen/Shell warnings and execute code without prompts. Publicly disclosed and exploited.

Updated: 2 weeks, 4 days ago

1 stars 0 fork 0 watcher

Born at : Feb. 11, 2026, 11:02 p.m. This repo has been linked 1 different CVEs too.

Sreedev-p/Whitehats

None

Updated: 2 weeks, 5 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 11, 2026, 6:33 a.m. This repo has been linked 1 different CVEs too.

ekomsSavior/Cerberus

Cerberus-CVE Assessment Situation

Python

Updated: 1 week, 6 days ago

13 stars 5 fork 5 watcher

Born at : Nov. 3, 2025, 7:46 p.m. This repo has been linked 6 different CVEs too.

zulloper/cve-poc

CVE POC repo 자동 수집기

Python

Updated: 2 days, 22 hours ago

6 stars 3 fork 3 watcher

Born at : June 8, 2025, 3:07 p.m. This repo has been linked 256 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 2 days, 4 hours ago

7549 stars 1241 fork 1241 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 753 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-21510 vulnerability anywhere in the article.

The Hacker News

Weekly Recap: Outlook Add-Ins Hijack, 0-Day Patches, Wormable Botnet & AI Malware

This week’s recap shows how small gaps are turning into big entry points. Not always through new exploits, often through tools, add-ons, cloud setups, or workflows that people already trust and rarely ...

Published Date: Feb 16, 2026 (2 weeks ago)

CybersecurityNews

Windows 11 KB5077181 Security Update Causing Some Devices to Restart in an Infinite Loop

Windows 11 KB5077181 Security Update Microsoft’s February 10, 2026, security update KB5077181 for Windows 11 versions 24H2 (build 26200.7840) and 25H2 (build 26100.7840) has triggered widespread repor ...

Published Date: Feb 15, 2026 (2 weeks, 1 day ago)

Help Net Security

Microsoft Patch Tuesday: 6 exploited zero-days fixed in February 2026

Microsoft has plugged 50+ security holes on February 2026 Patch Tuesday, including six zero-day vulnerabilities exploited by attackers in the wild. The “security feature bypass” zero-days Among the ze ...