CVE-2021-26887

<p>An elevation of privilege vulnerability exists in Microsoft Windows when Folder redirection has been enabled via Group Policy. When folder redirection file server is co-located with Terminal server, an attacker who successfully exploited the vulnerability would be able to begin redirecting another user's personal data to a created folder.</p> <p>To exploit the vulnerability, an attacker can create a new folder under the Folder Redirection root path and create a junction on a newly created User folder. When the new user logs in, Folder Redirection would start redirecting to the folder and copying personal data.</p> <p>This elevation of privilege vulnerability can only be addressed by reconfiguring Folder Redirection with Offline files and restricting permissions, and NOT via a security update for affected Windows Servers. See the <strong>FAQ</strong> section of this CVE for configuration guidance.</p>

• CWE-59

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26887Patch, Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26887Patch, Vendor Advisory

Published

Mar 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-26880Storage Spaces Controller Elevation of Privilege Vulnerabili…7.8
• CVE-2021-26881Microsoft Windows Media Foundation Remote Code Execution Vul…7.5
• CVE-2021-26882Remote Access API Elevation of Privilege Vulnerability7.8
• CVE-2021-26884Windows Media Photo Codec Information Disclosure Vulnerabili…5.5
• CVE-2021-26885Windows WalletService Elevation of Privilege Vulnerability7.8
• CVE-2021-26886User Profile Service Denial of Service Vulnerability6.1
• CVE-2021-26889Windows Update Stack Elevation of Privilege Vulnerability7.8
• CVE-2021-26890Application Virtualization Remote Code Execution Vulnerabili…7.8
• CVE-2021-26891Windows Container Execution Agent Elevation of Privilege Vul…7.8
• CVE-2021-26892Windows Extensible Firmware Interface Security Feature Bypas…6.2
• CVE-2021-26893Windows DNS Server Remote Code Execution Vulnerability9.8
• CVE-2021-26894Windows DNS Server Remote Code Execution Vulnerability9.8