CVE-2021-36955KEV · OVERDUE

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

High · published September 15, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 90.6th percentile for exploit probability.

1802
days past CISA
deadline
CVSS v3.1
7.8
EPSS
4%
Percentile
90.6
In the wild
Confirmed
What it is

🚨 A single misconfiguration in the Windows Common Log File System Driver could let an attacker gain elevated privileges! 🔥 Think of it like a security guard at a concert who mistakenly lets someone backstage without a proper pass — suddenly, they can access restricted areas! An attacker could exploit this vulnerability to gain elevated access, potentially leading to unauthorized actions like installing malicious software or accessing sensitive data. This could be absolutely devastating for system integrity and user privacy!

Put simply

Think of it like a security guard at a concert who mistakenly lets someone backstage without a proper pass — suddenly, they can access restricted areas! This elevation of privilege vulnerability arises from improper handling of objects in memory by the Common Log File System Driver, allowing attackers to execute arbitrary code with elevated privileges.

What to do

An attacker could exploit this vulnerability to gain elevated access, potentially leading to unauthorized actions like installing malicious software or accessing sensitive data. This could be absolutely devastating for system integrity and user privacy! To mitigate this risk, make sure to apply the latest security patches provided by Microsoft. Regularly update your systems and consider implementing stricter access controls to minimize exposure. Don't wait — this is a high-risk situation! You've got this! Stay vigilant and follow these steps to secure your systems! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04071 · 90.6th percentile
Published
2021-09-15T16:15Z
KEV added
2021-11-03 · due 2021-11-17
Affected products (19)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.1906010.0.10240.19060
microsoft/windows_10_1607< 10.0.14393.465110.0.14393.4651
microsoft/windows_10_1809< 10.0.17763.218310.0.17763.2183
microsoft/windows_10_1909< 10.0.18363.180110.0.18363.1801
microsoft/windows_10_2004< 10.0.19041.123710.0.19041.1237
microsoft/windows_10_20h2< 10.0.19042.123710.0.19042.1237
microsoft/windows_10_21h1< 10.0.19043.123710.0.19043.1237
microsoft/windows_7all versions—
microsoft/windows_8.1all versions—
microsoft/windows_rt_8.1all versions—
microsoft/windows_server_2004< 10.0.19041.123710.0.19041.1237
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.465110.0.14393.4651
microsoft/windows_server_2019< 10.0.17763.218310.0.17763.2183
microsoft/windows_server_2022< 10.0.20348.23010.0.20348.230
microsoft/windows_server_20h2< 10.0.19042.123710.0.19042.1237
References (3)
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by Nov 17
    kev
  • 15 SEP 11:23Z
    Windows Common Log File System Driver Elevation of Privilege Vulnerability
    cvelistv5