CVE-2026-10590
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A missing authentication vulnerability in Windows allows a local privileged attacker to use WMI commands to arbitrarily trigger a System Management Interrupt handler. This could lead to privilege escalation or system instability.
Risk Assessment
The organization faces the risk of a local attacker with privileges gaining control over hardware management mechanisms, potentially compromising system integrity or causing a denial-of-service condition.
Recommendation
Apply the security update provided by the operating system vendor immediately and restrict access to WMI commands for unauthorized users through appropriate group policies.
Other vulnerabilities in Windows
See all- CVE-2017-0166High
A privilege escalation vulnerability exists in Windows due to improper calculation of LDAP request buffer lengths. An attacker could exploit this vulnerability by sending malicious traffic to a Domain Controller using a specially crafted application.
- CVE-2023-45284Medium
The IsLocal function on Windows incorrectly detects reserved device names in some cases. Reserved names followed by spaces (e.g., "COM1 ") and names "COM" and "LPT" with superscript 1, 2, or 3 are incorrectly reported as local. The fix ensures IsLocal now correctly identifies these.
- CVE-2024-38217MediumActively exploited
Security feature bypass vulnerability in Windows Mark of the Web. It allows an attacker to bypass security protections related to files downloaded from the internet.
- CVE-2022-41091MediumActively exploited
Security feature bypass vulnerability in Windows Mark of the Web. It allows an attacker to bypass security protections related to files downloaded from the internet.
- CVE-2022-41049MediumActively exploited
Security feature bypass vulnerability in Windows Mark of the Web. It allows an attacker to bypass security protections related to files downloaded from the internet.
- CVE-2021-36934HighActively exploited
An elevation of privilege vulnerability exists due to overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker could run arbitrary code with SYSTEM privileges, install programs, view/change/delete data, or create new accounts with full user rights.
- CVE-2020-1067High
A remote code execution vulnerability in Windows due to improper handling of objects in memory. An attacker with a domain user account could exploit it by creating a specially crafted request. The update corrects how Windows handles objects in memory.
- CVE-2000-0222High
The installation for Windows 2000 does not activate the Administrator password until the system has rebooted, allowing remote attackers to connect to the ADMIN$ share without a password until the reboot occurs.
- CVE-1999-1105Medium
Windows 95, when Remote Administration and File Sharing for NetWare Networks is enabled, creates a share (C$) when an administrator logs in remotely, which allows remote attackers to read arbitrary files by mapping the network drive.
- CVE-1999-0444Medium
Remote attackers can perform a denial of service on Windows machines using malicious ARP packets, causing a message box to display for each packet or filling up log files.
Original NVD description (English source)
A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrarily trigger a System Management Interrupt handler.