CVE-2021-26424: Windows TCP/IP stack remote code execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCritical CVSS 9.9 network-reachable RCE in a core Windows component with very high EPSS, though no KEV listing or confirmed exploitation and the record lacks root-cause detail.

What it is

CVE-2021-26424 is a remote code execution vulnerability in the Windows TCP/IP stack affecting a broad set of Windows client and server releases. Microsoft rates it critical, and the record gives no root-cause detail beyond the generic CWE-noinfo entry, so the exact faulty component is unknown. It matters because a network-reachable RCE in a core protocol stack can compromise a host without user action.

Impact

An attacker who successfully exploits the flaw can execute arbitrary code on the target system, with the CVSS scope change indicating impact can extend beyond the vulnerable component. The record does not state whether code runs as SYSTEM or what privileges are ultimately obtained.

Attack surface

The CVSS vector is network-reachable (AV:N), low complexity, no user interaction, but requires low privileges (PR:L), so the attacker needs some existing foothold or credential on the target or an adjacent system rather than being fully unauthenticated. The description does not identify which TCP/IP feature or port is involved.

Exploitation

CISA KEV does not list this CVE, and the only reference tags are Patch and Vendor Advisory, so there is no public evidence of in-the-wild exploitation in this record. EPSS is high at 0.61133 (99th percentile), indicating elevated modeled likelihood of exploitation activity.

What to do

• Apply the Microsoft security update for CVE-2021-26424 on all affected Windows client and server versions; prioritize internet-facing and server systems.
• Restrict network exposure of affected hosts and segment them so a low-privileged foothold cannot reach additional Windows systems over TCP/IP.
• Enforce least privilege and monitor for unusual local account activity, since the vector requires low privileges.
• Retire or isolate end-of-support platforms in the affected list (Windows 7, Windows 8.1, Windows RT 8.1, Windows Server 2008/2012) that may no longer receive fixes.

Detection

• Monitor host and network telemetry for unexpected crashes or restarts of the Windows TCP/IP stack on patched and unpatched systems.
• Hunt for anomalous outbound or lateral TCP/IP traffic originating from low-privileged accounts or processes on affected hosts.
• Correlate Windows update inventory to find hosts still missing the August 2021 Microsoft cumulative updates covering this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.