First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-21517

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Improper link resolution before file access ('link following') in Windows App for Mac allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Microsoft	Windows App for Mac	>= 11.0.0, < 11.3.2

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21517Vendor Advisory

Timeline

Published: Feb 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-215188.8Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unaut CVE-2026-215197.8Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges CVE-2026-21527.2A vulnerability was found in D-Link DIR-615 4.10. This vulnerability affects unknown code of the file adv_routing.php of the component Web C CVE-2026-215207.5Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information CVE-2026-215217.4Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a netw CVE-2026-215226.7Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker t CVE-2026-215238.0Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a n CVE-2026-215247.4Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information ov CVE-2026-215256.2Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.CVE-2026-215276.5User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofi CVE-2026-215286.5Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.CVE-2026-215295.4Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to pe

CVE-2026-21517: High severity, CVSS 7.0 | Vulnix