CVE-2026-21237: Windows 10 21H2 Privilege Escalation Flaw

CVE-2026-21237 Overview

CVE-2026-21237 is a race condition vulnerability in the Windows Subsystem for Linux (WSL) that allows an authenticated local attacker to elevate privileges. The flaw is tracked under CWE-362, concurrent execution using a shared resource with improper synchronization. Successful exploitation grants high impact to confidentiality, integrity, and availability on the affected host. Microsoft published the advisory on February 10, 2026, covering multiple supported Windows client and Windows Server releases.

Critical Impact
A local attacker with low privileges who wins the race window can execute code in a higher-privileged WSL context, leading to full compromise of the host operating system.

Affected Products

Microsoft Windows 10 (21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2) on x64 and ARM64
Microsoft Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025

Discovery Timeline

2026-02-10 - CVE-2026-21237 published to NVD and Microsoft Security Response Center advisory released
2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-21237

Vulnerability Analysis

The vulnerability resides in the Windows Subsystem for Linux, the compatibility layer that runs Linux ELF binaries on Windows. WSL bridges Linux system calls and Windows kernel objects, and several of those interactions involve resources shared between user-mode WSL components and higher-privileged kernel or service components. Improper synchronization on one of those shared resources creates a Time-of-Check to Time-of-Use (TOCTOU) condition. An attacker who can run code as a standard user on the system can race a privileged operation and substitute or modify the shared state before it is consumed.

Exploitation requires local access and valid low-privilege credentials. Microsoft rates attack complexity as high, reflecting the precise timing required to win the race. When successful, the attacker breaks the trust boundary between the unprivileged WSL caller and the privileged component, gaining elevated execution on the Windows host.

Root Cause

The root cause is a lack of atomic validation and use of a shared resource within WSL. The privileged code path checks a property of the resource and then operates on it without holding an appropriate lock or recapturing state. A concurrent thread controlled by the attacker can change the resource between the check and the use, violating the assumption that the validated state still applies. This pattern is the classic TOCTOU defect described by CWE-362.

Attack Vector

The attack vector is local. The attacker must be authenticated on the target system and able to invoke WSL operations. Exploitation involves spawning concurrent threads or processes that interact with the WSL component, then repeatedly triggering the vulnerable code path while modifying the shared resource. Public exploit code is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No proof of concept has been released as of the advisory date. See the Microsoft CVE-2026-21237 Advisory for vendor technical details.

Detection Methods for CVE-2026-21237

Indicators of Compromise

Unexpected child processes spawned by wsl.exe, wslhost.exe, or wslservice.exe running with SYSTEM or elevated integrity
Repeated, rapid invocations of WSL interop interfaces by a single non-administrative user session
Linux-origin processes inside a WSL distribution issuing privileged Windows API calls outside normal interop patterns

Detection Strategies

Monitor Windows Security event logs for token elevation events (Event ID 4672, 4688) tied to WSL service binaries
Hunt for process creation chains where a standard user spawns WSL components that then create elevated Windows processes
Correlate high-frequency thread or handle creation against WSL service objects, which can indicate race-window brute forcing

Monitoring Recommendations

Enable command-line and parent-process logging via Windows Event 4688 and Sysmon Event ID 1 across all hosts with WSL installed
Inventory endpoints where the Windows Subsystem for Linux optional component is enabled and prioritize monitoring of those systems
Forward WSL-related telemetry to a centralized analytics platform for cross-host pattern analysis and anomaly detection

How to Mitigate CVE-2026-21237

Immediate Actions Required

Apply the security updates published in the Microsoft CVE-2026-21237 Advisory to all affected Windows 10, Windows 11, and Windows Server systems
Identify hosts with WSL enabled using dism /online /get-features or Get-WindowsOptionalFeature and prioritize patching
Restrict local logon rights and remove unnecessary standard user accounts from systems where WSL is installed

Patch Information

Microsoft has issued security updates addressing CVE-2026-21237 through the standard monthly update channel. Patches are available for Windows 10 21H2 and 22H2, Windows 11 23H2, 24H2, and 25H2, and Windows Server 2022, 2022 23H2, and 2025. Consult the Microsoft CVE-2026-21237 Advisory for the specific KB article that applies to each build.

Workarounds

Disable the Windows Subsystem for Linux optional feature on systems where it is not required for business operations
Limit interactive and Remote Desktop access to trusted administrators on hosts where WSL must remain enabled until patching completes
Apply application control policies, such as Windows Defender Application Control or AppLocker, to restrict execution of unauthorized binaries within WSL contexts

bash

# Disable WSL where it is not required (run as administrator)
Dism.exe /online /disable-feature /featurename:Microsoft-Windows-Subsystem-Linux /norestart
Dism.exe /online /disable-feature /featurename:VirtualMachinePlatform /norestart

# Verify current WSL feature state
Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux