CVE-2026-24290: 
vulnerability analysis and mitigation

CVE-2026-24290 is a local privilege escalation vulnerability caused by improper access control in the Windows Projected File System (ProjFS). It allows an authorized low-privileged attacker to elevate privileges locally without user interaction. The vulnerability was disclosed on March 10, 2026, as part of Microsoft's March 2026 Patch Tuesday. Affected products span a wide range of Windows versions including Windows 10 (21H2, 22H2, 1809), Windows 11 (23H2, 24H2, 25H2, 26H1), Windows Server 2019, 2022, 2022 23H2, and Windows Server 2025. It carries a CVSS v3.1 base score of 7.8 (High) (Microsoft MSRC).

The root cause is classified as CWE-284 (Improper Access Control) within the Windows Projected File System (ProjFS) component, a Windows feature that allows applications to project a virtual file system. An attacker with low-privileged local access can exploit the improper access control logic to gain elevated privileges, potentially reaching SYSTEM level. The attack vector is local, requires low privileges, no user interaction, and has low attack complexity, making it straightforward to exploit once local access is obtained (Microsoft MSRC). No public technical write-up or proof-of-concept code has been identified at this time.

Successful exploitation allows a low-privileged local attacker to escalate to SYSTEM-level privileges, resulting in high confidentiality, integrity, and availability impact on the affected system. An attacker achieving SYSTEM privileges can access all files and data, install malware, disable security controls, and potentially use the compromised host as a pivot point for lateral movement within a network. The scope is limited to the affected system (unchanged scope), but full system compromise is achievable (Microsoft MSRC).

Microsoft released patches on March 10, 2026, as part of Patch Tuesday. Administrators should update affected systems to the following minimum build versions or later:

• Windows 10 Version 1809 / Windows Server 2019: 10.0.17763.8511
• Windows 10 Version 21H2: 10.0.19044.7058
• Windows 10 Version 22H2: 10.0.19045.7058
• Windows 11 Version 23H2: 10.0.22631.6783
• Windows 11 Version 24H2: 10.0.26100.7979
• Windows 11 Version 25H2: 10.0.26200.7979
• Windows 11 Version 26H1: 10.0.28000.1719
• Windows Server 2022: 10.0.20348.4830
• Windows Server 2022 23H2: 10.0.25398.2207
• Windows Server 2025: 10.0.26100.32463

As a compensating control, apply the principle of least privilege to limit local user accounts and monitor for suspicious privilege escalation activity while patches are being deployed (Microsoft MSRC).

The vulnerability was covered as part of broader March 2026 Patch Tuesday roundups by several security outlets. Rapid7, Zero Day Initiative, Sophos, and Lansweeper all published patch Tuesday reviews that included this CVE among the 78 vulnerabilities addressed that month (Rapid7 Blog, ZDI Blog, Sophos Blog). No notable individual researcher commentary or significant social media discussion specific to this CVE has been identified.