CVE-2026-84020: Windows 10 Version 21H2 10.0.19044.0 to before 10.0.19044.7807; +9 more affected products

Affected technology

Windows 10 Version 21H2 · 10.0.19044.0 to before 10.0.19044.7807
Microsoft

Windows 10 Version 22H2 · 10.0.19045.0 to before 10.0.19044.7807
Microsoft

Windows 11 version 23H2 · 10.0.22631.0 to before 10.0.22631.7652
Microsoft

Windows 11 Version 24H2 · 10.0.26100.0 to before 10.0.26100.9711
Microsoft

Windows 11 Version 25H2 · 10.0.26200.0 to before 10.0.26200.9711
Microsoft

Windows 11 version 26H1 · 10.0.28000.0 to before 10.0.28000.3231
Microsoft

Windows 11 Version 26H2 · 10.0.26300.0 to before 10.0.26300.9711
Microsoft

Windows Server 2022 · 10.0.20348.0 to before 10.0.20348.5761
Microsoft

Windows Server 2025 · 10.0.26100.0 to before 10.0.26100.33650
Microsoft

Windows Server 2025 (Server Core installation) · 10.0.26100.0 to before 10.0.26100.33650
Microsoft

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

The source says use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. Vendor/CNA’s CVSS 3.1 assessment (base score 7.0/10) rates confidentiality, integrity and availability impact as high.