CVE-2021-26887 - Vulnerability Details

An elevation of privilege vulnerability exists in Microsoft Windows when Folder redirection has been enabled via Group Policy. When folder redirection file server is co-located with Terminal server, an attacker who successfully exploited the vulnerability would be able to begin redirecting another user's personal data to a created folder.
To exploit the vulnerability, an attacker can create a new folder under the Folder Redirection root path and create a junction on a newly created User folder. When the new user logs in, Folder Redirection would start redirecting to the folder and copying personal data.
This elevation of privilege vulnerability can only be addressed by reconfiguring Folder Redirection with Offline files and restricting permissions, and NOT via a security update for affected Windows Servers. See the FAQ section of this CVE for configuration guidance.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00921.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Microsoft Subscribe	Windows 10 Subscribe Windows 10 1507 Subscribe Windows 10 1607 Subscribe Windows 10 1809 Subscribe Windows 10 1909 Subscribe Windows 10 20h2 Subscribe Windows 7 Subscribe Windows 8.1 Subscribe Windows Rt 8.1 Subscribe Windows Server 1909 Subscribe Windows Server 2004 Subscribe Windows Server 2008 Subscribe Windows Server 2008 R2 Subscribe Windows Server 2008 Sp2 Subscribe Windows Server 2012 Subscribe Windows Server 2012 R2 Subscribe Windows Server 2016 Subscribe Windows Server 2019 Subscribe Windows Server 20h2 Subscribe

Configuration 1 [-]

OR	cpe:2.3:o:microsoft:windows_10:-:::::::*
	cpe:2.3:o:microsoft:windows_10:20h2:::::::*
	cpe:2.3:o:microsoft:windows_10:1607:::::::*
	cpe:2.3:o:microsoft:windows_10:1803:::::::*
	cpe:2.3:o:microsoft:windows_10:1809:::::::*
	cpe:2.3:o:microsoft:windows_10:1909:::::::*
	cpe:2.3:o:microsoft:windows_10:2004:::::::*
	cpe:2.3:o:microsoft:windows_7:-:sp1::::::
	cpe:2.3:o:microsoft:windows_8.1:-:::::::*
	cpe:2.3:o:microsoft:windows_rt_8.1:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2008:-:sp2::::::
	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*
	cpe:2.3:o:microsoft:windows_server_2016:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2016:20h2:::::::*
	cpe:2.3:o:microsoft:windows_server_2016:1909:::::::*
	cpe:2.3:o:microsoft:windows_server_2016:2004:::::::*
	cpe:2.3:o:microsoft:windows_server_2019:-:::::::*

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2021-13671	<p>An elevation of privilege vulnerability exists in Microsoft Windows when Folder redirection has been enabled via Group Policy. When folder redirection file server is co-located with Terminal server, an attacker who successfully exploited the vulnerability would be able to begin redirecting another user's personal data to a created folder.</p> <p>To exploit the vulnerability, an attacker can create a new folder under the Folder Redirection root path and create a junction on a newly created User folder. When the new user logs in, Folder Redirection would start redirecting to the folder and copying personal data.</p> <p>This elevation of privilege vulnerability can only be addressed by reconfiguring Folder Redirection with Offline files and restricting permissions, and NOT via a security update for affected Windows Servers. See the <strong>FAQ</strong> section of this CVE for configuration guidance.</p>

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26887
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26887

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description	<p>An elevation of privilege vulnerability exists in Microsoft Windows when Folder redirection has been enabled via Group Policy. When folder redirection file server is co-located with Terminal server, an attacker who successfully exploited the vulnerability would be able to begin redirecting another user's personal data to a created folder.</p> <p>To exploit the vulnerability, an attacker can create a new folder under the Folder Redirection root path and create a junction on a newly created User folder. When the new user logs in, Folder Redirection would start redirecting to the folder and copying personal data.</p> <p>This elevation of privilege vulnerability can only be addressed by reconfiguring Folder Redirection with Offline files and restricting permissions, and NOT via a security update for affected Windows Servers. See the <strong>FAQ</strong> section of this CVE for configuration guidance.</p>	An elevation of privilege vulnerability exists in Microsoft Windows when Folder redirection has been enabled via Group Policy. When folder redirection file server is co-located with Terminal server, an attacker who successfully exploited the vulnerability would be able to begin redirecting another user's personal data to a created folder. To exploit the vulnerability, an attacker can create a new folder under the Folder Redirection root path and create a junction on a newly created User folder. When the new user logs in, Folder Redirection would start redirecting to the folder and copying personal data. This elevation of privilege vulnerability can only be addressed by reconfiguring Folder Redirection with Offline files and restricting permissions, and NOT via a security update for affected Windows Servers. See the FAQ section of this CVE for configuration guidance.
First Time appeared		Microsoft windows 10 1507 Microsoft windows 10 1607 Microsoft windows 10 1809 Microsoft windows 10 1909 Microsoft windows 10 20h2 Microsoft windows Server 1909 Microsoft windows Server 2004 Microsoft windows Server 2008 R2 Microsoft windows Server 2008 Sp2 Microsoft windows Server 2012 R2 Microsoft windows Server 20h2
CPEs		cpe:2.3:o:microsoft:windows_10_1507:::::::x86:* cpe:2.3:o:microsoft:windows_10_1607:::::::x86:* cpe:2.3:o:microsoft:windows_10_1809:::::::arm64:* cpe:2.3:o:microsoft:windows_10_1809:::::::x64:* cpe:2.3:o:microsoft:windows_10_1809:::::::x86:* cpe:2.3:o:microsoft:windows_10_1909:::::::x86:* cpe:2.3:o:microsoft:windows_10_20H2:::::::x86:* cpe:2.3:o:microsoft:windows_7::sp1:::::x64: cpe:2.3:o:microsoft:windows_7::sp1:::::x86: cpe:2.3:o:microsoft:windows_8.1:::::::x86:* cpe:2.3:o:microsoft:windows_server_1909:::::::: cpe:2.3:o:microsoft:windows_server_2004:::::::: cpe:2.3:o:microsoft:windows_server_2008_R2:::::::x64:* cpe:2.3:o:microsoft:windows_server_2008_sp2:::::::x64:* cpe:2.3:o:microsoft:windows_server_2012_R2:::::::x64:* cpe:2.3:o:microsoft:windows_server_2016:::::::: cpe:2.3:o:microsoft:windows_server_2019:::::::: cpe:2.3:o:microsoft:windows_server_20H2::::::::
Vendors & Products		Microsoft windows 10 1507 Microsoft windows 10 1607 Microsoft windows 10 1809 Microsoft windows 10 1909 Microsoft windows 10 20h2 Microsoft windows Server 1909 Microsoft windows Server 2004 Microsoft windows Server 2008 R2 Microsoft windows Server 2008 Sp2 Microsoft windows Server 2012 R2 Microsoft windows Server 20h2
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26887

Tue, 24 Feb 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description	<p>An elevation of privilege vulnerability exists in Microsoft Windows when Folder redirection has been enabled via Group Policy. When folder redirection file server is co-located with Terminal server, an attacker who successfully exploited the vulnerability would be able to begin redirecting another user's personal data to a created folder.</p> <p>To exploit the vulnerability, an attacker can create a new folder under the Folder Redirection root path and create a junction on a newly created User folder. When the new user logs in, Folder Redirection would start redirecting to the folder and copying personal data.</p> <p>This elevation of privilege vulnerability can only be addressed by reconfiguring Folder Redirection with Offline files and restricting permissions, and NOT via a security update for affected Windows Servers. See the <strong>FAQ</strong> section of this CVE for configuration guidance.</p>	<p>An elevation of privilege vulnerability exists in Microsoft Windows when Folder redirection has been enabled via Group Policy. When folder redirection file server is co-located with Terminal server, an attacker who successfully exploited the vulnerability would be able to begin redirecting another user's personal data to a created folder.</p> <p>To exploit the vulnerability, an attacker can create a new folder under the Folder Redirection root path and create a junction on a newly created User folder. When the new user logs in, Folder Redirection would start redirecting to the folder and copying personal data.</p> <p>This elevation of privilege vulnerability can only be addressed by reconfiguring Folder Redirection with Offline files and restricting permissions, and NOT via a security update for affected Windows Servers. See the <strong>FAQ</strong> section of this CVE for configuration guidance.</p>

Tue, 19 Nov 2024 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2021-03-11T15:42:16.000Z

Updated: 2026-08-19T16:30:31.969Z

Reserved: 2021-02-08T00:00:00.000Z

Link: CVE-2021-26887

Vulnrichment

Updated: 2024-08-03T20:33:41.285Z

NVD

Status : Modified

Published: 2021-03-11T16:15:15.800

Modified: 2026-08-19T17:17:44.767

Link: CVE-2021-26887

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-59

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Projects

JSON object

JSON object

JSON object

JSON object

JSON object