CVE-2021-43226KEV · OVERDUE

Microsoft Windows Privilege Escalation Vulnerability

High · published December 15, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 88.4th percentile for exploit probability.

362
days past CISA
deadline
CVSS v3.1
7.8
EPSS
3%
Percentile
88.4
In the wild
Confirmed
What it is

⚡ An elevation of privilege vulnerability in the Windows Common Log File System could let an attacker run processes with elevated permissions—no cape required! 🚀 Think of it like a janitor at a hotel who finds a master key and suddenly has access to every room, including the penthouse suite. This vulnerability allows a crafty attacker to gain unauthorized control over system resources, all while bypassing security checks. If exploited, this vulnerability could allow an attacker to execute malicious code with elevated system privileges, potentially leading to unauthorized access to sensitive data or the ability to modify critical system settings. It’s a big deal, and a breach like this could have absolutely devastating effects on your system’s security integrity!

Put simply

Think of it like a janitor at a hotel who finds a master key and suddenly has access to every room, including the penthouse suite. This vulnerability allows a crafty attacker to gain unauthorized control over system resources, all while bypassing security checks. This vulnerability arises from improper handling of objects in memory by the Windows Common Log File System driver. An attacker who successfully exploits this flaw can elevate their privileges and execute arbitrary code in the context of a system-level account, leading to serious security ramifications.

What to do

If exploited, this vulnerability could allow an attacker to execute malicious code with elevated system privileges, potentially leading to unauthorized access to sensitive data or the ability to modify critical system settings. It’s a big deal, and a breach like this could have absolutely devastating effects on your system’s security integrity! Update your Windows systems to the latest versions that address this vulnerability. Microsoft has released patches; ensure they’re installed immediately to block potential exploits. Regularly review your security policies to safeguard against privilege escalation risks. This is fixable! Stay vigilant and follow these steps to fortify your defenses—security hero status: activated! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03275 · 88.4th percentile
Published
2021-12-15T20:15Z
KEV added
2025-10-06 · due 2025-10-27
Affected products (25)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.1914510.0.10240.19145
microsoft/windows_10_1507< 10.0.10240.1914510.0.10240.19145
microsoft/windows_10_1607< 10.0.14393.482510.0.14393.4825
microsoft/windows_10_1607< 10.0.14393.482510.0.14393.4825
microsoft/windows_10_1809< 10.0.17763.236610.0.17763.2366
microsoft/windows_10_1909< 10.0.18363.197710.0.18363.1977
microsoft/windows_10_2004< 10.0.19041.141510.0.19041.1415
microsoft/windows_10_20h2< 10.0.19042.141510.0.19042.1415
microsoft/windows_10_20h2< 10.0.19042.141510.0.19042.1415
microsoft/windows_10_21h1< 10.0.19043.141510.0.19043.1415
microsoft/windows_10_21h2< 10.0.19044.141510.0.19044.1415
microsoft/windows_11_21h2< 10.0.22000.37610.0.22000.376
microsoft/windows_7all versions—
microsoft/windows_8.1all versions—
microsoft/windows_rt_8.1all versions—
microsoft/windows_server_2004< 10.0.19041.141510.0.19041.1415
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.482510.0.14393.4825
microsoft/windows_server_2019< 10.0.17763.236610.0.17763.2366
microsoft/windows_server_2022< 10.0.20348.40510.0.20348.405
microsoft/windows_server_20h2< 10.0.19042.141510.0.19042.1415
References (3)
EPSS history
Timeline
  • 06 OCT 00:00Z
    Added to CISA KEV — remediate by Oct 27
    kev
  • 15 DEC 14:15Z
    Windows Common Log File System Driver Elevation of Privilege Vulnerability
    cvelistv5