CVE-2021-26899
Status: ModifiedHigh (7.8)—
Windows UPnP Device Host Elevation of Privilege Vulnerability
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Base score: 7.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.97%
- Percentile among all scored CVEs: 61
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (8)
CWEs
- NVD-CWE-noinfo
References
Raw JSON (NVD)
Show
{
"id": "CVE-2021-26899",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.2,
"accessVector": "LOCAL",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
},
{
"type": "Secondary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "secure@microsoft.com",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Windows 10 Version 1507",
"versions": [
{
"status": "affected",
"version": "10.0.10240.0",
"lessThan": "10.0.10240.18874",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 10 Version 1607",
"versions": [
{
"status": "affected",
"version": "10.0.14393.0",
"lessThan": "10.0.14393.4283",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 10 Version 1803",
"versions": [
{
"status": "affected",
"version": "10.0.0",
"lessThan": "10.0.17134.2087",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"ARM64-based Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 10 Version 1809",
"versions": [
{
"status": "affected",
"version": "10.0.17763.0",
"lessThan": "10.0.17763.1817",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 10 Version 1809",
"versions": [
{
"status": "affected",
"version": "10.0.0",
"lessThan": "10.0.17763.1817",
"versionType": "custom"
}
],
"platforms": [
"ARM64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 10 Version 1909",
"versions": [
{
"status": "affected",
"version": "10.0.0",
"lessThan": "10.0.18363.1440",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"ARM64-based Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 10 Version 2004",
"versions": [
{
"status": "affected",
"version": "10.0.0",
"lessThan": "10.0.19043.867",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"ARM64-based Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 10 Version 20H2",
"versions": [
{
"status": "affected",
"version": "10.0.0",
"lessThan": "10.0.19043.867",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"ARM64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 7",
"versions": [
{
"status": "affected",
"version": "6.1.0",
"lessThan": "6.1.7601.24566",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 7 Service Pack 1",
"versions": [
{
"status": "affected",
"version": "6.1.0",
"lessThan": "6.1.7601.24566",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows 8.1",
"versions": [
{
"status": "affected",
"version": "6.3.0",
"lessThan": "6.3.9600.19968",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"ARM64-based Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2008 R2 Service Pack 1",
"versions": [
{
"status": "affected",
"version": "6.1.7601.0",
"lessThan": "6.1.7601.24566",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)",
"versions": [
{
"status": "affected",
"version": "6.1.7601.0",
"lessThan": "6.1.7601.24566",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2008 Service Pack 2",
"versions": [
{
"status": "affected",
"version": "6.0.6003.0",
"lessThan": "6.0.6003.21070",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2008 Service Pack 2 (Server Core installation)",
"versions": [
{
"status": "affected",
"version": "6.0.6003.0",
"lessThan": "6.0.6003.21070",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2012",
"versions": [
{
"status": "affected",
"version": "6.2.9200.0",
"lessThan": "6.2.9200.23298",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2012 (Server Core installation)",
"versions": [
{
"status": "affected",
"version": "6.2.9200.0",
"lessThan": "6.2.9200.23298",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2012 R2",
"versions": [
{
"status": "affected",
"version": "6.3.9600.0",
"lessThan": "6.3.9600.19968",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2012 R2 (Server Core installation)",
"versions": [
{
"status": "affected",
"version": "6.3.9600.0",
"lessThan": "6.3.9600.19968",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2016",
"versions": [
{
"status": "affected",
"version": "10.0.14393.0",
"lessThan": "10.0.14393.4283",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2016 (Server Core installation)",
"versions": [
{
"status": "affected",
"version": "10.0.14393.0",
"lessThan": "10.0.14393.4283",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2019",
"versions": [
{
"status": "affected",
"version": "10.0.17763.0",
"lessThan": "10.0.17763.1817",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2019 (Server Core installation)",
"versions": [
{
"status": "affected",
"version": "10.0.17763.0",
"lessThan": "10.0.17763.1817",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server version 2004",
"versions": [
{
"status": "affected",
"version": "10.0.0",
"lessThan": "10.0.19043.867",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server version 20H2",
"versions": [
{
"status": "affected",
"version": "10.0.0",
"lessThan": "10.0.19043.867",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Windows Server, version 1909 (Server Core installation)",
"versions": [
{
"status": "affected",
"version": "10.0.0",
"lessThan": "10.0.18363.1440",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
}
]
}
],
"published": "2021-03-11T16:15:16.503",
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26899",
"source": "secure@microsoft.com"
},
{
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26899",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Windows UPnP Device Host Elevation of Privilege Vulnerability"
},
{
"lang": "es",
"value": "Una Vulnerabilidad de Elevación de Privilegios de UPnP Device Host de Windows"
}
],
"lastModified": "2026-08-19T17:17:46.710",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "084984D5-D241-497B-B118-50C6C1EAD468"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:*",
"vulnerable": true,
"matchCriteriaId": "BA592626-F17C-4F46-823B-0947D102BBD2"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:-:*",
"vulnerable": true,
"matchCriteriaId": "EBBC793C-D584-46DA-BCD1-2844810152B0"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "897A48D7-FCA1-4560-AFBB-718AF19BA3A2"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x86:*",
"vulnerable": true,
"matchCriteriaId": "507EB48C-F479-424C-8ABA-C279AB4FE3F4"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:-:*",
"vulnerable": true,
"matchCriteriaId": "4503B88E-3ECB-4B0A-A813-077157D1EF0C"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:-:*",
"vulnerable": true,
"matchCriteriaId": "DBE7565D-AC25-4017-B2E4-4B463D7680DB"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:-:*",
"vulnerable": true,
"matchCriteriaId": "6EE4C8CA-0351-499C-9E59-D31CEA7BC7B0"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:-:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "85A7C1C6-7390-4B26-8FED-F067EC3DF1A0"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:-:*:x86:*",
"vulnerable": true,
"matchCriteriaId": "2E91BCB5-D0F7-4D53-BC85-D114C2D87A9C"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:-:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "9D654D3A-6A99-4904-8B37-E52E80F7C85A"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:-:*:x86:*",
"vulnerable": true,
"matchCriteriaId": "01A6D6B4-B97F-4C8C-AD09-11454F0A39CE"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C6CE5198-C498-4672-AF4C-77AB4BE06C5C"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "AF07A81D-12E5-4B1D-BFF9-C8D08C32FF4F"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2008:sp2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "66CAFDB7-9D41-4E67-AB83-5EB104551FF5"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2008:sp2:*:*:*:*:x86:*:*",
"vulnerable": true,
"matchCriteriaId": "DC633D8A-2E7A-4115-95AC-555C42F4942D"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:-:*:-:*",
"vulnerable": true,
"matchCriteriaId": "44A1A867-3DAC-4C42-A091-E07B6672EE6F"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:20h2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4A190388-AA82-4504-9D5A-624F23268C9F"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C253A63F-03AB-41CB-A03A-B2674DEA98AA"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0B60D940-80C7-49F0-8F4E-3F99AC15FA82"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB79EE26-FC32-417D-A49C-A1A63165A968"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secure@microsoft.com"
}