CVE-2026-21517

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Improper link resolution before file access ('link following') in Windows App for Mac allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

No affected versions have been published.

Timeline

Published
Feb 10, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-215188.8Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unautCVE-2026-215197.8Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges CVE-2026-21527.2A vulnerability was found in D-Link DIR-615 4.10. This vulnerability affects unknown code of the file adv_routing.php of the component Web CCVE-2026-215207.5Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive informationCVE-2026-215217.4Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a netwCVE-2026-215226.7Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker tCVE-2026-215238.0Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a nCVE-2026-215247.4Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information ovCVE-2026-215256.2Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.CVE-2026-215276.5User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofiCVE-2026-215286.5Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.CVE-2026-215295.4Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to pe
CVE-2026-21517: High severity, CVSS 7.0 | Vulnix