CVE-2021-1675

Confirmed PUBLISHED

Windows Print Spooler Remote Code Execution Vulnerability

Microsoft · Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

7.8 High

At a Glance

Windows Print Spooler Remote Code Execution Vulnerability

microsoft cisa malware windows ransomware metasploit

CVE Published: Jun 08, 2021
Exploitation Reported: Nov 03, 2021
CVSS: 7.8 High
EPSS: —

Low complexity Unauthenticated

Affected Versions

28 version rows · page 1 of 2

Vendor	Product	Version	Status
Microsoft	Windows 10 Version 1809	10.0.0 to < 10.0.17763.1999	Affected
Microsoft	Windows Server 2019	10.0.0 to < 10.0.17763.1999	Affected
Microsoft	Windows Server 2019 (Server Core installation)	10.0.0 to < 10.0.17763.1999	Affected
Microsoft	Windows 10 Version 1909	10.0.0 to < 10.0.18363.1621	Affected
Microsoft	Windows 10 Version 21H1	10.0.0 to < 10.0.19043.1052	Affected
Microsoft	Windows 10 Version 2004	10.0.0 to < 10.0.19041.1052	Affected
Microsoft	Windows Server version 2004	10.0.0 to < 10.0.19041.1052	Affected
Microsoft	Windows 10 Version 20H2	10.0.0 to < 10.0.19042.1052	Affected
Microsoft	Windows Server version 20H2	10.0.0 to < 10.0.19042.1052	Affected
Microsoft	Windows 10 Version 1507	10.0.0 to < 10.0.10240.18967	Affected
Microsoft	Windows 10 Version 1607	10.0.0 to < 10.0.14393.4467	Affected
Microsoft	Windows Server 2016	10.0.0 to < 10.0.14393.4467	Affected
Microsoft	Windows Server 2016 (Server Core installation)	10.0.0 to < 10.0.14393.4467	Affected
Microsoft	Windows 7	6.1.0 to < 6.1.7601.25632	Affected
Microsoft	Windows 7 Service Pack 1	6.1.0 to < 6.1.7601.25632	Affected
Microsoft	Windows 8.1	6.3.0 to < 6.3.9600.20045	Affected
Microsoft	Windows 8.1	6.3.0 to < 6.3.9600.20044	Affected
Microsoft	Windows Server 2008 Service Pack 2	6.0.0 to < 6.0.6003.21137	Affected
Microsoft	Windows Server 2008 Service Pack 2 (Server Core installation)	6.0.0 to < 6.0.6003.21137	Affected
Microsoft	Windows Server 2008 Service Pack 2	6.0.0 to < 6.0.6003.21137	Affected
Microsoft	Windows Server 2008 R2 Service Pack 1	6.1.0 to < 6.1.7601.25632	Affected
Microsoft	Windows Server 2008 R2 Service Pack 1 (Server Core installation)	6.0.0 to < 6.1.7601.25632	Affected
Microsoft	Windows Server 2012	6.2.0 to < 6.2.9200.23372	Affected
Microsoft	Windows Server 2012 (Server Core installation)	6.2.0 to < 6.2.9200.23372	Affected
Microsoft	Windows Server 2012 R2	6.3.0 to < 6.3.9600.20045	Affected

CVE References

VU#383432 kb.cert.org · Third-Party Advisory https://www.kb.cert.org/vuls/id/383432
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1675 portal.msrc.microsoft.com · CVE Record https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CV...
packetstormsecurity.com/files/163349/Microsoft-PrintNightmare-Proof-... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/163349/Microsoft-PrintNightmare-...
packetstormsecurity.com/files/163351/PrintNightmare-Windows-Spooler-... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/163351/PrintNightmare-Windows-Sp...
packetstormsecurity.com/files/167261/Print-Spooler-Remote-DLL-Inject... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/167261/Print-Spooler-Remote-DLL-...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2021-11-03 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 7.8 High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Exploitation Status

Exploited in the wild

Recorded 2021-11-03 00:00:00 UTC · CISA

Used in malware

Recorded 2021-11-03 00:00:00 UTC · CISA

Proof of concept available

Recorded 2021-06-29 14:24:30 UTC · GitHub

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb	Apr 28, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

whoami-chmod777/CVE-2021-1675-CVE-2021-34527

github · Created 2024-02-12 20:54:51 UTC · 1 stars

TheJoyOfHacking/calebstewart-CVE-2021-1675

github · Created 2022-02-22 03:32:34 UTC · 2 stars

AndrewTrube/CVE-2021-1675

github · Created 2022-01-30 04:47:44 UTC · 5 stars

PrintNightmare Local Privilege Escalation

OppressionBreedsResistance/CVE-2021-1675-PrintNightmare

github · Created 2021-10-05 19:24:23 UTC · 1 stars

Working PowerShell POC

mstxq17/CVE-2021-1675_RDL_LPE

github · Created 2021-09-01 11:25:04 UTC · 148 stars

PrintNightMare LPE提权漏洞的CS 反射加载插件。开箱即用、通过内存加载、混淆加载的驱动名称来ByPass Defender/EDR。

hahaleyile/my-CVE-2021-1675

github · Created 2021-07-22 10:49:30 UTC · 3 stars

see https://github.com/cube0x0/CVE-2021-1675

zha0/Microsoft-CVE-2021-1675

github · Created 2021-07-18 15:00:27 UTC · 0 stars

galoget/PrintNightmare-CVE-2021-1675-CVE-2021-34527

github · Created 2021-07-12 08:18:40 UTC · 0 stars

CVE-2021-1675 / CVE-2021-34527 - PrintNightmare Python, C# and PowerShell Exploits Implementations (LPE & RCE)

bartimusprimed/CVE-2021-1675-Yara

github · Created 2021-07-08 16:18:52 UTC · 2 stars

exploitblizzard/PrintNightmare-CVE-2021-1675

github · Created 2021-07-04 09:50:39 UTC · 5 stars

Youtube : https://youtu.be/Zr0KjYDSFKQ

corelight/CVE-2021-1675

github · Created 2021-07-02 16:44:24 UTC · 9 stars

killtr0/CVE-2021-1675-PrintNightmare

github · Created 2021-07-02 16:12:15 UTC · 2 stars

thomasgeens/CVE-2021-1675

github · Created 2021-07-02 06:14:29 UTC · 3 stars

Leonidus0x10/CVE-2021-1675-SCANNER

github · Created 2021-07-02 01:45:00 UTC · 10 stars

Vulnerability Scanner for CVE-2021-1675/PrintNightmare

calebstewart/CVE-2021-1675

github · Created 2021-07-01 23:45:58 UTC · 1050 stars

Pure PowerShell implementation of CVE-2021-1675 Print Spooler Local Privilege Escalation (PrintNightmare)

tanarchytan/CVE-2021-1675

github · Created 2021-07-01 19:50:46 UTC · 0 stars

Fix without disabling Print Spooler

cybersecurityworks553/CVE-2021-1675_PrintNightMare

github · Created 2021-07-01 13:58:01 UTC · 23 stars

puckiestyle/CVE-2021-1675

github · Created 2021-07-01 12:24:19 UTC · 1 stars

hlldz/CVE-2021-1675-LPE

github · Created 2021-07-01 09:47:13 UTC · 333 stars

Local Privilege Escalation Edition for CVE-2021-1675/CVE-2021-34527

evilashz/CVE-2021-1675-LPE-EXP

github · Created 2021-07-01 09:00:31 UTC · 59 stars

PrintNightmare , Local Privilege Escalation of CVE-2021-1675 or CVE-2021-34527

LaresLLC/CVE-2021-1675

github · Created 2021-06-30 18:32:17 UTC · 216 stars

CVE-2021-1675 Detection Info

cube0x0/CVE-2021-1675

github · Created 2021-06-29 17:24:14 UTC · 1881 stars

C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527

yu2u/CVE-2021-1675

github · Created 2021-06-29 14:24:30 UTC · 2 stars

CVE-2021-1675 exploit

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2021-1675

{
  "cve_id": "CVE-2021-1675",
  "title": "Windows Print Spooler Remote Code Execution Vulnerability",
  "affected_vendor": "Microsoft",
  "affected_product": "Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008  Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 7.8,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2021-1675

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API