CVE-2026-26128
Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.
- Affected products
- Windows
- Microsoft Windows 10 1607
- < 10.0.14393.8957
- Microsoft Windows 10 1809
- < 10.0.17763.8511
- Microsoft Windows 10 21h2
- < 10.0.19044.7058
- Microsoft Windows 10 22h2
- < 10.0.19045.7058
- Microsoft Windows 11 23h2
- < 10.0.22631.6783
- Microsoft Windows 11 24h2
- < 10.0.26100.7979
- CVSS 3.1
- 7.8 HIGH
- EPSS
- 0.6% (46th percentile)
- Weakness
- CWE-287
- NVD status
- Modified
- Published
- 2026-03-10
CVE-2026-26128 at NVD
2 known exploits for CVE-2026-26128
Proof-of-concept code and exploit modules indexed by Sploitus