# CVE-2021-26887: Microsoft Windows Folder Redirection Elevation of Privilege Vulnerability

CVE-2021-26887 is fixed in 2 products on 1 platform, first by KB5000840, released March 9, 2021. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2021-26887
- Priority: High
- CVSS: 7.8 (Important)
- EPSS: 0.0107
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Vendor exploitability assessment: Exploitation Less Likely
- Published: Mar 15, 2021
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26887

## Description

<p>An elevation of privilege vulnerability exists in Microsoft Windows when Folder redirection has been enabled via Group Policy. When folder redirection file server is co-located with Terminal server, an attacker who successfully exploited the vulnerability would be able to begin redirecting another user's personal data to a created folder.</p> <p>To exploit the vulnerability, an attacker can create a new folder under the Folder Redirection root path and create a junction on a newly created User folder. When the new user logs in, Folder Redirection would start redirecting to the folder and copying personal data.</p> <p>This elevation of privilege vulnerability can only be addressed by reconfiguring Folder Redirection with Offline files and restricting permissions, and NOT via a security update for affected Windows Servers. See the <strong>FAQ</strong> section of this CVE for configuration guidance.</p>

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Microsoft | Windows Server 2012 |  | [KB5000840](https://patchblox.com/security/data/fix/microsoft/kb5000840.md) | Mar 9, 2021 |
| Microsoft | Windows Server 2012 |  | [KB5000847](https://patchblox.com/security/data/fix/microsoft/kb5000847.md) | Mar 9, 2021 |
| Microsoft | Windows Server 2012 (Server Core installation) |  | [KB5000840](https://patchblox.com/security/data/fix/microsoft/kb5000840.md) | Mar 9, 2021 |
| Microsoft | Windows Server 2012 (Server Core installation) |  | [KB5000847](https://patchblox.com/security/data/fix/microsoft/kb5000847.md) | Mar 9, 2021 |

---

Data as of 2026-11-09T13:31:49Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.