KEVIntel
Back to KEVs
7.8
CVSS
High

CVE-2021-36934

PUBLISHED

Windows Elevation of Privilege Vulnerability

Exploited in the wild Low complexity No user interaction
Vendor
Microsoft
Product
Windows 10 Version 1809, Windows 10 Version 1909, Windows 10 Version 21H1, Windows 10 Version 2004, Windows 10 Version 20H2
Published
Jul 22, 2021
EPSS
—

Description

An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.

windows cisa microsoft

CVSS scores

CVSS v3.1 7.8 High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:T/RC:C

Exploitation status

Exploited in the wild

Recorded 2022-02-10 00:00:00 UTC · Source

SSVC decision points

Exploitation
active
Automatable
No
Technical impact
total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
CISA Feb 10, 2022

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

grishinpv/poc_CVE-2021-36934

github · Created 2021-08-02 13:47:17 UTC · 2 stars

POC experiments with Volume Shadow copy Service (VSS)

websecnl/CVE-2021-36934

github · Created 2021-08-01 19:54:31 UTC · 2 stars

SeriousSAM Auto Exploiter

exploitblizzard/CVE-2021-36934

github · Created 2021-07-27 06:54:30 UTC · 7 stars

HiveNightmare aka SeriousSAM

0x0D1n/CVE-2021-36934

github · Created 2021-07-26 08:01:08 UTC · 1 stars

Preventions/CVE-2021-36934

github · Created 2021-07-24 14:58:10 UTC · 3 stars

C# PoC for CVE-2021-36934/HiveNightmare/SeriousSAM

VertigoRay/CVE-2021-36934

github · Created 2021-07-22 14:53:09 UTC · 2 stars

Windows Elevation of Privilege Vulnerability (SeriousSAM)

tda90/CVE-2021-36934

github · Created 2021-07-22 12:24:24 UTC · 1 stars

CVE-2021-36934 PowerShell Fix

n3tsurge/CVE-2021-36934

github · Created 2021-07-21 17:24:44 UTC · 5 stars

Detection and Mitigation script for CVE-2021-36934 (HiveNightmare aka. SeriousSam)

JoranSlingerland/CVE-2021-36934

github · Created 2021-07-21 13:06:51 UTC · 10 stars

Fix for the CVE-2021-36934

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel