CVE-2021-36942KEV · OVERDUE

Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability

High · published August 12, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 99.3th percentile for exploit probability.

1803
days past CISA
deadline
CVSS v3.1
7.5
EPSS
66%
Percentile
99.3
In the wild
Confirmed
What it is

🚨 This vulnerability lets attackers impersonate the Local Security Authority (LSA) on Windows systems — like a con artist posing as your trusted building manager! ⚡ Picture a receptionist who can access sensitive areas simply by wearing a fake ID badge. This LSA spoofing flaw allows an attacker to bypass authentication and access network resources as if they were an authorized user. If exploited, attackers could gain full control of the system, read sensitive data, and potentially spread to other connected networks. This is absolutely devastating for any organization, as they could lose sensitive information or face ransomware attacks.

Put simply

Picture a receptionist who can access sensitive areas simply by wearing a fake ID badge. This LSA spoofing flaw allows an attacker to bypass authentication and access network resources as if they were an authorized user. CVE-2021-36942 is a spoofing vulnerability that allows an attacker to impersonate the LSA, leading to potential unauthorized access to system resources and sensitive data. This flaw affects how security tokens are issued and validated.

What to do

If exploited, attackers could gain full control of the system, read sensitive data, and potentially spread to other connected networks. This is absolutely devastating for any organization, as they could lose sensitive information or face ransomware attacks. To protect against this vulnerability, ensure that all Windows systems are updated to the latest security patch from Microsoft. Disable unnecessary services and monitor for unusual activity as well. Don't delay; the sooner you act, the safer you'll be! You've got this! By following these steps, you'll bolster your defenses and secure your systems in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.66023 · 99.3th percentile
Published
2021-08-12T22:15Z
KEV added
2021-11-03 · due 2021-11-17
Affected products (8)
ProductVersionsFixed in
microsoft/windows_server_2004< 10.0.19041.116510.0.19041.1165
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.458310.0.14393.4583
microsoft/windows_server_2019< 10.0.17763.211410.0.17763.2114
microsoft/windows_server_20h2< 10.0.19042.116510.0.19042.1165
References (4)
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by Nov 17
    kev
  • 12 AUG 18:12Z
    Windows LSA Spoofing Vulnerability
    cvelistv5