CVE-2021-40488

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Storage Spaces Controller Elevation of Privilege Vulnerability

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 1809	>= 10.0.0, < 10.0.17763.2237
Microsoft	Windows Server 2019	>= 10.0.0, < 10.0.17763.2237
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.0, < 10.0.17763.2237
Microsoft	Windows 10 Version 1909	>= 10.0.0, < 10.0.18363.1854
Microsoft	Windows 10 Version 21H1	>= 10.0.0, < 10.0.19043.1288
Microsoft	Windows Server 2022	>= 10.0.0, < 10.0.20348.288
Microsoft	Windows 10 Version 2004	>= 10.0.0, < 10.0.19041.1288
Microsoft	Windows Server version 2004	>= 10.0.0, < 10.0.19041.1288
Microsoft	Windows 10 Version 20H2	>= 10.0.0, < 10.0.19042.1288
Microsoft	Windows Server version 20H2	>= 10.0.0, < 10.0.19042.1288
Microsoft	Windows 11 version 21H2	>= 10.0.0, < 10.0.22000.258
Microsoft	Windows 10 Version 1507	>= 10.0.0, < 10.0.10240.19086
Microsoft	Windows 10 Version 1607	>= 10.0.0, < 10.0.14393.4704
Microsoft	Windows Server 2016	>= 10.0.0, < 10.0.14393.4704
Microsoft	Windows Server 2016 (Server Core installation)	>= 10.0.0, < 10.0.14393.4704
Microsoft	Windows 8.1	>= 6.3.0, < 6.3.9600.20144
Microsoft	Windows Server 2012	>= 6.2.0, < 6.2.9200.23490
Microsoft	Windows Server 2012 (Server Core installation)	>= 6.2.0, < 6.2.9200.23490
Microsoft	Windows Server 2012 R2	>= 6.3.0, < 6.3.9600.20144
Microsoft	Windows Server 2012 R2 (Server Core installation)	>= 6.3.0, < 6.3.9600.20144

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40488Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1153/Third Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40488Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1153/Third Party Advisory

Timeline

Published: Oct 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-404897.8Storage Spaces Controller Elevation of Privilege Vulnerability CVE-2021-40496.5livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-404907.0A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13.CVE-2021-404916.5The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server ad CVE-2021-404926.1A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaSc CVE-2021-404939.8Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObjec CVE-2021-404949.8A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system.CVE-2021-404955.3There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751 CVE-2021-404964.3SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attack CVE-2021-404975.3SAP BusinessObjects Analysis (edition for OLAP) - versions 420, 430, allows an attacker to exploit certain application endpoints to read sen CVE-2021-404985.5A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacke CVE-2021-404999.8Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI,