CVE-2021-40476
7.5 HIGHWindows AppContainer Elevation Of Privilege Vulnerability
Published: 2021-10-13 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 7.5 HIGH
- Vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
- CWE
- CWE-522
Affected products
| Vendor | Product |
|---|---|
| microsoft | windows_10, windows_11, windows_8.1 |
Description
Windows AppContainer Elevation Of Privilege Vulnerability
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-40476
- [Other]http://packetstormsecurity.com/files/164942/Microsoft-Windows-WSAQuerySocketSecurity-AppContainer-Privilege-Escalation.html
- [Patch]https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40476
- [Other]http://packetstormsecurity.com/files/164942/Microsoft-Windows-WSAQuerySocketSecurity-AppContainer-Privilege-Escalation.html
- [Patch]https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40476
Related CVEs
Same vendor
- CVE-2026-50512 — Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privilege... (7.8 HIGH)
- CVE-2026-50511 — Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privilege... (7.8 HIGH)
- CVE-2026-50507 — Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack (6.8 MEDIUM)
- CVE-2026-49161 — Improper access control in Microsoft PC Manager allows an authorized attacker to bypass a security feature locally (7.8 HIGH)
- CVE-2026-49160 — Uncontrolled resource consumption in HTTP/2 allows an unauthorized attacker to deny service over a network (7.5 HIGH)
Same CWE
- CVE-2026-53840 — OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configur... (7.1 HIGH)
- CVE-2026-6517 — Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in ... (6.3 MEDIUM)
- CVE-2026-49949 — CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercept sensitive crede... (5.3 MEDIUM)
- CVE-2024-45636 — IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileged user (4.1 MEDIUM)
- CVE-2026-41715 — In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials (6.1 MEDIUM)