High · published July 22, 2021
CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.3th percentile for exploit probability.
🚨 An attacker could tap into SYSTEM-level privileges due to overly permissive Access Control Lists on critical system files! ⚡ Think of it like a hotel where anyone can access the master key — they can not only enter any room, but also change locks, delete guests, or even install new security systems without permission! If exploited, an attacker could run arbitrary code with SYSTEM privileges, allowing them to install programs, view, change, or delete data, and create new accounts with full user rights. This could lead to a complete takeover of the system, resulting in devastating consequences for the victim's data and security.
Think of it like a hotel where anyone can access the master key — they can not only enter any room, but also change locks, delete guests, or even install new security systems without permission! This elevation of privilege vulnerability arises from overly permissive ACLs on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who executes code on a vulnerable machine can gain elevated privileges to manipulate the system at will.
If exploited, an attacker could run arbitrary code with SYSTEM privileges, allowing them to install programs, view, change, or delete data, and create new accounts with full user rights. This could lead to a complete takeover of the system, resulting in devastating consequences for the victim's data and security. To protect your system, promptly install the security update and make sure to manually delete all shadow copies of system files, including the SAM database. Simply installing the update isn't enough; following the instructions in KB5005357 is crucial for full mitigation. You've got this! With these steps, you'll secure your system and keep those pesky attackers at bay! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| microsoft/windows_10_1809 | < 10.0.17763.2114 | 10.0.17763.2114 |
| microsoft/windows_10_1909 | < 10.0.18363.1734 | 10.0.18363.1734 |
| microsoft/windows_10_2004 | < 10.0.19041.1165 | 10.0.19041.1165 |
| microsoft/windows_10_20h2 | < 10.0.19042.1165 | 10.0.19042.1165 |
| microsoft/windows_10_21h1 | < 10.0.19043.1165 | 10.0.19043.1165 |