CVE WatchAug 10, 2026

CVE-2024-21412

Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability

CVSS

8.1

High

EPSS

99.4%

p100

KEV

YES

Feb 13, 2024

Exploit Today

0-100

Published: Feb 13, 2024 · Last modified: Aug 10, 2026 · CWE-693

EPSS · 30d

95.4%EPSS · 30 days99.4%

2026-09-162026-10-14

KEV catalog record

Product

Microsoft / Windows

Vulnerability

Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability

Added to KEV

Feb 13, 2024

Remediate by

Mar 5, 2024

Known ransomware use

Yes

Summary description

Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21412; https://nvd.nist.gov/vuln/detail/CVE-2024-21412

Technical description

Internet Shortcut Files Security Feature Bypass Vulnerability

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1108664.7 MED

—

——0Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.8h CVE-2026-1106895.3 MED

—

——0A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. Performing a manipulation results in protection mechanism failure. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.1.7 will fix this issue. The patch is named 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.10h CVE-2026-668746.5 MED

—

——0For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from running. Because skipped statuses count as success, branch protection or organization-required workflow checks can appear satisfied without the mandated workflow executing; no runner or maintainer approval is required for this path.15h CVE-2026-969518.8 HIG

73.8%

KEV—72Microsoft Windows Command Injection Vulnerability13h CVE-2026-9460310.0 CRI

59.4%

——18Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.1d CVE-2026-888385.5 MED

1.3%

——0A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.14h