CVE-2021-36934KEV · OVERDUE

Microsoft Windows SAM Local Privilege Escalation Vulnerability

High · published July 22, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.3th percentile for exploit probability.

1703
days past CISA
deadline
CVSS v3.1
7.8
EPSS
67%
Percentile
99.3
In the wild
Confirmed
What it is

🚨 An attacker could tap into SYSTEM-level privileges due to overly permissive Access Control Lists on critical system files! ⚡ Think of it like a hotel where anyone can access the master key — they can not only enter any room, but also change locks, delete guests, or even install new security systems without permission! If exploited, an attacker could run arbitrary code with SYSTEM privileges, allowing them to install programs, view, change, or delete data, and create new accounts with full user rights. This could lead to a complete takeover of the system, resulting in devastating consequences for the victim's data and security.

Put simply

Think of it like a hotel where anyone can access the master key — they can not only enter any room, but also change locks, delete guests, or even install new security systems without permission! This elevation of privilege vulnerability arises from overly permissive ACLs on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who executes code on a vulnerable machine can gain elevated privileges to manipulate the system at will.

What to do

If exploited, an attacker could run arbitrary code with SYSTEM privileges, allowing them to install programs, view, change, or delete data, and create new accounts with full user rights. This could lead to a complete takeover of the system, resulting in devastating consequences for the victim's data and security. To protect your system, promptly install the security update and make sure to manually delete all shadow copies of system files, including the SAM database. Simply installing the update isn't enough; following the instructions in KB5005357 is crucial for full mitigation. You've got this! With these steps, you'll secure your system and keep those pesky attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.67252 · 99.3th percentile
Published
2021-07-22T11:15Z
KEV added
2022-02-10 · due 2022-02-24
Affected products (5)
ProductVersionsFixed in
microsoft/windows_10_1809< 10.0.17763.211410.0.17763.2114
microsoft/windows_10_1909< 10.0.18363.173410.0.18363.1734
microsoft/windows_10_2004< 10.0.19041.116510.0.19041.1165
microsoft/windows_10_20h2< 10.0.19042.116510.0.19042.1165
microsoft/windows_10_21h1< 10.0.19043.116510.0.19043.1165
References (5)
EPSS history
Timeline
  • 10 FEB 00:00Z
    Added to CISA KEV — remediate by Feb 24
    kev
  • 22 JUL 07:05Z
    Windows Elevation of Privilege Vulnerability
    cvelistv5