CVE-2026-21240: 
vulnerability analysis and mitigation

CVE-2026-21240 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in the Windows HTTP.sys kernel driver that allows a locally authenticated, low-privileged attacker to elevate privileges on the affected system. Disclosed on February 10, 2026, as part of Microsoft's Patch Tuesday release, it affects a wide range of Windows versions including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), Windows Server 2019, Windows Server 2022, and Windows Server 2025. It carries a CVSS v3.1 base score of 7.0 (High) (Microsoft MSRC).

The vulnerability is classified as CWE-367 (Time-of-Check Time-of-Use Race Condition) and resides in the HTTP.sys kernel-mode driver, which handles HTTP request processing at the OS level. An attacker can exploit the window between a security check and the subsequent use of a resource by racing a concurrent operation to manipulate the resource state, thereby bypassing access controls and gaining elevated privileges. Exploitation requires local access with low privileges and no user interaction, but the high attack complexity reflects the timing-dependent nature of race condition exploitation. Attack patterns associated with this vulnerability include CAPEC-27 (Leveraging Race Conditions via Symbolic Links) and CAPEC-29 (Leveraging TOCTOU Race Conditions) (Microsoft MSRC).

Successful exploitation allows a low-privileged local attacker to achieve full elevation of privilege, potentially reaching SYSTEM-level access on the compromised host. This results in high confidentiality, integrity, and availability impact — an attacker with SYSTEM privileges can read sensitive data, modify system configurations, install malware, disable security controls, and use the compromised host as a pivot point for lateral movement within a network. The broad scope of affected products — spanning consumer Windows 10/11 and enterprise Windows Server editions — significantly widens the potential attack surface (Microsoft MSRC).

Microsoft released security updates on February 10, 2026, addressing this vulnerability across all affected platforms. Administrators should apply the relevant cumulative updates to bring systems to the following minimum build versions: Windows 10 1809 / Server 2019 → 10.0.17763.8389; Windows 10 21H2 → 10.0.19044.6937; Windows 10 22H2 → 10.0.19045.6937; Windows 11 23H2 → 10.0.22631.6649; Windows 11 24H2 → 10.0.26100.7781; Windows 11 25H2 → 10.0.26200.7781; Windows Server 2022 → 10.0.20348.4711; Windows Server 2022 23H2 → 10.0.25398.2149; Windows Server 2025 → 10.0.26100.32313. As a defense-in-depth measure, organizations should restrict local user account creation, enforce least-privilege access policies, and monitor for unusual HTTP.sys driver activity or unexpected privilege escalation events (Microsoft MSRC).

The vulnerability was covered as part of broader February 2026 Patch Tuesday roundups by multiple security vendors and researchers. Qualys, Rapid7, Sophos, and BleepingComputer all included it in their Patch Tuesday analyses, noting it as one of several privilege escalation vulnerabilities addressed in the February 2026 update cycle (Qualys Blog, BleepingComputer, Sophos Blog). Community sentiment reflected standard urgency for a High-severity local privilege escalation, with no exceptional alarm given the absence of active exploitation or a public PoC.