CVE-2026-21709

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Apr 17, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-21719.8A vulnerability was found in code-projects Online Student Management System 1.0. Affected is an unknown function of the file accounts.php ofCVE-2026-217107.5A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the apCVE-2026-217115.3A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission cheCVE-2026-217126.5A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalizedCVE-2026-217135.9A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timingCVE-2026-217145.3A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow cCVE-2026-217153.3A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, whiCVE-2026-217163.3An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permissioCVE-2026-217175.9A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially prCVE-2026-217189.8An authentication bypass vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, enabling any attackers to bypass the authentiCVE-2026-217198.6An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute CVE-2026-21729.8A vulnerability was determined in code-projects Online Application System for Admission 1.0. Affected by this vulnerability is an unknown fu