High · published August 12, 2021
CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 97.6th percentile for exploit probability.
⚡ An unauthorized user can elevate their privileges on Windows systems with just a few crafty moves! Think of it like a hotel receptionist who, without checking, gives out master keys to random guests — suddenly, anyone can access any room! 🏨 This vulnerability allows malicious users to gain elevated privileges, potentially giving them access to sensitive data, the ability to install software, or even control the system itself. With such power, they could wreak absolute havoc, like throwing a wild party in a hotel room without the owner's permission!
Think of it like a hotel receptionist who, without checking, gives out master keys to random guests — suddenly, anyone can access any room! 🏨 The Windows User Profile Service flaw lets attackers exploit improper access control, leading to privilege escalation. Basically, it opens a door for non-admin users to take on the roles and responsibilities of an admin without the proper authorization.
This vulnerability allows malicious users to gain elevated privileges, potentially giving them access to sensitive data, the ability to install software, or even control the system itself. With such power, they could wreak absolute havoc, like throwing a wild party in a hotel room without the owner's permission! Update Windows to the latest version immediately to mitigate this vulnerability. Make sure to review user permissions and access controls to prevent unauthorized privilege escalation. Regular system audits can also help catch any unauthorized access. 🔒 You’ve got this! With the right patches and precautions, you can keep your systems secure and your users safe! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| microsoft/windows_10_1507 | < 10.0.10240.19022 | 10.0.10240.19022 |
| microsoft/windows_10_1607 | < 10.0.14393.4583 | 10.0.14393.4583 |
| microsoft/windows_10_1809 | < 10.0.17763.2114 | 10.0.17763.2114 |
| microsoft/windows_10_1909 | < 10.0.18363.1734 | 10.0.18363.1734 |
| microsoft/windows_10_2004 | < 10.0.19041.1165 | 10.0.19041.1165 |
| microsoft/windows_10_20h2 | < 10.0.19042.1165 | 10.0.19042.1165 |
| microsoft/windows_10_21h1 | < 10.0.19043.1165 | 10.0.19043.1165 |
| microsoft/windows_7 | all versions | — |
| microsoft/windows_8.1 | all versions | — |
| microsoft/windows_rt_8.1 | all versions | — |
| microsoft/windows_server_2004 | < 10.0.19041.1165 | 10.0.19041.1165 |
| microsoft/windows_server_2008 | all versions | — |
| microsoft/windows_server_2008 | all versions | — |
| microsoft/windows_server_2012 | all versions | — |
| microsoft/windows_server_2012 | all versions | — |
| microsoft/windows_server_2016 | < 10.0.14393.4583 | 10.0.14393.4583 |
| microsoft/windows_server_2019 | < 10.0.17763.2114 | 10.0.17763.2114 |
| microsoft/windows_server_20h2 | < 10.0.19042.1165 | 10.0.19042.1165 |