Vulnerability record · CVE-2021-24086 · published 25 February 2021
CVE-2021-24086: Windows TCP/IP stack denial of service
Microsoft · Windows 10
CVE-2021-24086 is a denial of service flaw in the Windows TCP/IP stack. A remote, unauthenticated attacker can send crafted network traffic that causes the affected system to become unresponsive. The record gives no root-cause detail beyond the generic description, so the exact parsing or handling defect is not specified.
Description
Windows TCP/IP Denial of Service Vulnerability
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityRemote, unauthenticated denial of service with a 7.5 CVSS score and very high EPSS percentile, though no KEV listing or confirmed exploitation.
What it is
CVE-2021-24086 is a denial of service flaw in the Windows TCP/IP stack. A remote, unauthenticated attacker can send crafted network traffic that causes the affected system to become unresponsive. The record gives no root-cause detail beyond the generic description, so the exact parsing or handling defect is not specified.
Impact
An attacker can disrupt or halt network processing on a vulnerable Windows host, denying service to legitimate users and dependent services. No confidentiality or integrity impact is indicated by the CVSS vector.
Attack surface
Reachable over the network via the TCP/IP stack, as reflected by the AV:N vector. No authentication or user interaction is required (PR:N, UI:N).
Exploitation
Not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded. EPSS is high (0.58961, 99th percentile), indicating elevated predicted exploitation likelihood, and references include a Packet Storm advisory alongside the Microsoft patch.
What to do
- Apply the Microsoft security update referenced in the vendor advisory for CVE-2021-24086.
- Prioritize patching internet-facing and perimeter Windows systems, including the listed server and client versions.
- Restrict or filter unnecessary inbound traffic to exposed TCP/IP services where feasible.
- Monitor vendor guidance for any updated affected-version or workaround information.
Detection
- Monitor for sudden loss of network responsiveness or service outages on Windows hosts that cannot be tied to legitimate load.
- Alert on spikes in malformed or anomalous TCP/IP traffic targeting Windows endpoints and servers.
- Correlate host unavailability events with concurrent network telemetry to identify a remote trigger pattern.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/163499/Windows-TCP-IP-Denial-Of-Service.html | Third Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24086 | PatchVendor Advisory |
| http://packetstormsecurity.com/files/163499/Windows-TCP-IP-Denial-Of-Service.html | Third Party AdvisoryVDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24086 | PatchVendor Advisory |
Track CVE-2021-24086 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-24086), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
