Security readout for executives and security teams
Plain-English summary
This low-severity Windows flaw could cause an interacting user’s system to disclose limited NTLM-related information through locally triggered spoofing. It does not affect availability or integrity according to the supplied CVSS data. Exploitation requires local access conditions and user interaction, limiting immediate business risk.
Executive priority
Treat this as routine but required patching, not an emergency response. Track remediation through the normal Windows update cycle and escalate systems with greater NTLM dependence or delayed patching. Current evidence does not support active-exploitation claims.
Technical view
CVE-2026-21249 is a CWE-73 external filename or path control issue in Windows NTLM. Its CVSS 3.1 score is 3.3: local attack vector, low complexity, no privileges, user interaction required, unchanged scope, and low confidentiality impact. The supplied data identifies an official Microsoft fix but provides no update identifiers.
Likely exposure
Potential exposure spans the listed Windows 10, Windows 11, and Windows Server releases, including several Server Core installations. Actual exposure depends on the exact edition, build, and patch status. The supplied affected list contains duplicate or inconsistent Windows 11 naming, so confirm applicability against Microsoft’s advisory.
Exploitation context
The supplied record does not cite active exploitation, and KEV is false. The CVSS exploit-maturity metric is unproven. Exploitation is locally initiated, requires user interaction, and is described as causing limited confidentiality impact; no integrity or availability impact is identified.
Researcher notes
The source describes spoofing through externally controlled filename or path handling but provides no detailed trigger, attack flow, or affected component boundaries. CVSS indicates local, unauthenticated conditions with required user interaction and confidentiality-only impact. Exact fixed builds and update identifiers must be obtained from Microsoft. Avoid relying on inconsistent affected-product labels without vendor confirmation.
Mitigation direction
- Review Microsoft’s CVE advisory for the security update matching each Windows edition and build.
- Deploy the applicable Microsoft security updates through the organization’s normal patch process.
- Prioritize systems where NTLM remains operationally important or untrusted local content is commonly handled.
- Use Microsoft guidance for any compensating controls when immediate patching is not possible.
Validation and detection
- Inventory the listed Windows editions, versions, installation types, and build numbers.
- Compare installed update status with Microsoft’s CVE advisory for each exact operating-system build.
- Confirm patched systems completed installation and any vendor-required restart.
- Re-scan affected assets and investigate exceptions, unsupported systems, or inconsistent product identification.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-73: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-21249 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C1.81.4microsoftVulnerability scoring details
Base CVSS 3.1 score
3.3LowVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Windows NTLM Spoofing VulnerabilityCVE reference, microsoft · vendor-advisory, patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
External Control of File Name or Path
External Control of File Name or Path represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.