CVE-2026-21240: Windows 10 1809 Privilege Escalation Flaw

CVE-2026-21240 Overview

CVE-2026-21240 is a time-of-check time-of-use (TOCTOU) race condition in the Windows HTTP.sys kernel-mode driver. An authorized local attacker can exploit the race window between validation and use of a resource to elevate privileges on the affected host. Microsoft published the advisory on February 10, 2026, and the issue is tracked under CWE-367. The flaw affects current Windows 10, Windows 11, and Windows Server releases including Server 2019, 2022, and 2025. Successful exploitation yields high impact to confidentiality, integrity, and availability on the local system.

Critical Impact
Local privilege escalation to SYSTEM-level execution through a TOCTOU race in the Windows HTTP protocol stack driver.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2) — x86, x64, ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2) — x64, ARM64
Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2026-02-10 - CVE-2026-21240 published to NVD
2026-02-10 - Microsoft releases security update guidance
2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-21240

Vulnerability Analysis

The vulnerability resides in HTTP.sys, the kernel-mode driver that handles HTTP request parsing, response generation, and connection management for Windows services such as IIS, WinRM, and WCF. A TOCTOU defect exists between the moment the driver validates a resource or state and the moment it consumes that resource. An authorized attacker who can race the validation step can substitute attacker-controlled state and cause the kernel to act on data it never validated. Because HTTP.sys runs in kernel context, manipulating its execution path can yield code execution or memory corruption at the highest privilege level.

Root Cause

The root cause is classified as CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition. The driver checks the properties of a shared resource and then reuses those properties later without re-validating or holding a lock. A second thread or concurrent request can modify the resource between the check and the use. The non-atomic sequence breaks the security assumptions that follow the validation step.

Attack Vector

The attack vector is local and requires low privileges, but attack complexity is high because the attacker must reliably win the race window. No user interaction is required. A local user, service account, or any process able to issue requests to the local HTTP stack can attempt to trigger the race. Successful exploitation pivots a low-privileged context into SYSTEM, enabling persistence, credential theft, or lateral movement.

No public proof-of-concept code is available for CVE-2026-21240 at the time of writing. See the Microsoft Security Update Guide for vendor-provided technical context.

Detection Methods for CVE-2026-21240

Indicators of Compromise

Unexpected SYSTEM-level child processes spawned from services that depend on HTTP.sys such as w3wp.exe, WinRM, or custom HTTP listeners.
Kernel crash events (BugCheck, Event ID 1001) referencing HTTP.sys shortly after high-frequency local HTTP request bursts.
New scheduled tasks, services, or accounts created immediately after anomalous activity from an HTTP-bound service account.

Detection Strategies

Hunt for local processes opening repeated handles to \Device\Http or issuing tight loops of HTTP.sys IOCTLs, which is consistent with race-window exploitation.
Correlate token elevation events (Event ID 4672) for accounts that should not normally hold privileged tokens, especially when chained to HTTP service activity.
Apply behavioral identification rules that flag privilege transitions from low-integrity HTTP worker processes to SYSTEM.

Monitoring Recommendations

Enable kernel-mode auditing and forward HTTP.sys event logs and Windows Error Reporting data to a centralized SIEM for correlation.
Baseline normal HTTP request volume per local process and alert on sudden bursts paired with elevation events.
Track installation status of the February 2026 Microsoft cumulative update across all Windows endpoints and servers.

How to Mitigate CVE-2026-21240

Immediate Actions Required

Apply the February 2026 Microsoft security update referenced in the MSRC advisory to all affected Windows 10, Windows 11, and Windows Server systems.
Prioritize patching of internet-facing servers running IIS, WinRM, or other HTTP.sys-backed services and any multi-tenant hosts where local accounts exist.
Audit local accounts and service principals that have shell or API access to vulnerable systems and remove unnecessary local logon rights.

Patch Information

Microsoft has released cumulative updates that remediate CVE-2026-21240 for all supported Windows client and server SKUs listed in the affected products section. Refer to the Microsoft Security Update Guide entry for CVE-2026-21240 for build numbers and KB identifiers per OS version. No supported configuration is excluded from the fix.

Workarounds

No official workaround is documented; the patch is the supported remediation path.
Reduce local attack surface by restricting interactive logon and removing unused HTTP listeners with netsh http show urlacl and netsh http delete urlacl.
Enforce least privilege for application pool identities and service accounts so that a successful race still lands the attacker in a constrained context.

bash

# Verify patch installation status on a Windows host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Enumerate registered HTTP URL ACLs to identify exposed listeners
netsh http show urlacl