CVE-2021-36934: Microsoft Windows SAM Local Privilege Escalation Vulnerability

Vulnerability summary

CVE-2021-36934 is a high (CVSS 7.8) vulnerability in Microsoft Windows. It is known to be exploited: CISA lists it, first on 10-02-2022. EPSS estimates a 67.25% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 22-07-2021
   PublishedVulnerability first disclosed.
2. 10-02-2022
   Added to CISA KEVMicrosoft Windows SAM Local Privilege Escalation Vulnerability
3. 24-02-2022
   CISA remediation dueApply updates per vendor instructions.
4. 10-08-2026
   Last modifiedVulnerability information updated.

Description

An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.

No weakness data has been published for this record.