CVE-2021-36934highunder attack

CVE-2021-36934: high-severity vulnerability in Microsoft Windows 10 Version 1809

Windows Elevation of Privilege Vulnerability

Published 22 Jul 2021 · Updated 10 Aug 2026

Follow this CVE + Monitor Windows

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 7.8epss 67%

from disclosure to weaponsame day

Published on NVDJul 22

1st PoCAug 9

metasploitJul 20

CISA KEV+203d

Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAPT29🇷🇺 MITRE ATT&CK

Action required by CISAfederal deadline: 2022-02-24

Apply updates per vendor instructions.

In short

Windows has overly loose security permissions on critical system files like the SAM database, allowing someone who can run code on your computer to gain full SYSTEM privileges and take complete control. This is serious because an attacker could install malware, steal data, or create unauthorized accounts.

Technical detail

Elevation of privilege vulnerability stemming from overly permissive ACLs on system files including the SAM database, exploitable by an attacker with local code execution capability to escalate privileges to SYSTEM level. Successful exploitation enables arbitrary code execution with full system privileges; remediation requires both security update installation and manual deletion of Volume Shadow Copies to prevent bypass via snapshot restore.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:T/RC:C

Affected products

Microsoft · Windows 10 Version 1809 Microsoft · Windows 10 Version 1909 Microsoft · Windows 10 Version 2004 Microsoft · Windows 10 Version 20H2 Microsoft · Windows 10 Version 21H1

public PoCs found — 46

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — Microsoft Windows 10 Version 1809

In the same product, most dangerous first.

CVE-2021-31166CRITICALHTTP Protocol Stack Remote Code Execution VulnerabilityEPSS 99.9%KEV CVE-2021-34527HIGHWindows Print Spooler Remote Code Execution VulnerabilityEPSS 99.8%KEV CVE-2023-36884HIGHWindows Search Remote Code Execution VulnerabilityEPSS 99.4%KEV CVE-2024-21412HIGHInternet Shortcut Files Security Feature Bypass VulnerabilityEPSS 99.4%KEV CVE-2022-30190HIGHMicrosoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityEPSS 99.2%KEV CVE-2021-40444HIGHMicrosoft MSHTML Remote Code Execution VulnerabilityEPSS 97.8%KEV

References

http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.html https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36934 https://www.kb.cert.org/vuls/id/506989