CVE-2021-24084

Think of this like a locked filing cabinet inside your Windows system that, due to a software flaw, can be opened by someone who only has a basic (non-admin) account on the same computer. That person can then read sensitive “mobile device management” information stored on the machine. No click from users is needed—just being present on the same device.

This matters if you run Windows 10 or Windows Server on computers that have multiple user accounts or where an attacker could gain low-level access to a machine (for example, via stolen credentials). The flaw is local, meaning the attacker must already have low-level access on that same device. Reachability depends on whether a malicious user can get an account on the machine—there’s no indication this is remotely reachable from the internet in the default setup.

This is RED because a low-privileged local user can directly read confidential mobile device management data from the machine. If your environment allows attackers to gain even basic account access on Windows 10/Windows Server systems, the data exposure risk is immediate once that foothold exists. The fix is available, so the safest move is to update these Windows builds without waiting.