CVE-2021-36934

Windows Elevation of Privilege Vulnerability

Basic Information

CVE State: PUBLISHED
Reserved Date: July 19, 2021
Published Date: July 22, 2021
Last Updated: February 04, 2025
Vendor: Microsoft
Product: Windows 10 Version 1809, Windows 10 Version 1909, Windows 10 Version 21H1, Windows 10 Version 2004, Windows 10 Version 20H2
Description: An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.

CVSS Scores

CVSS v3.1

7.8 - HIGH

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:T/RC:C

SSVC Information

Exploitation: active
Technical Impact: total

Exploit Status

Exploited in the Wild: Yes (added 2022-02-10 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2021-08-02 13:47:17 UTC) Source

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934 http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.html

Known Exploited Vulnerability Information

Source	Added Date
CISA	2022-02-10 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

grishinpv/poc_CVE-2021-36934

Type: github • Created: 2021-08-02 13:47:17 UTC • Stars: 2

POC experiments with Volume Shadow copy Service (VSS)

websecnl/CVE-2021-36934

Type: github • Created: 2021-08-01 19:54:31 UTC • Stars: 2

SeriousSAM Auto Exploiter

exploitblizzard/CVE-2021-36934

Type: github • Created: 2021-07-27 06:54:30 UTC • Stars: 7

HiveNightmare aka SeriousSAM

0x0D1n/CVE-2021-36934

Type: github • Created: 2021-07-26 08:01:08 UTC • Stars: 1

Preventions/CVE-2021-36934

Type: github • Created: 2021-07-24 14:58:10 UTC • Stars: 3

C# PoC for CVE-2021-36934/HiveNightmare/SeriousSAM

VertigoRay/CVE-2021-36934

Type: github • Created: 2021-07-22 14:53:09 UTC • Stars: 2

Windows Elevation of Privilege Vulnerability (SeriousSAM)

tda90/CVE-2021-36934

Type: github • Created: 2021-07-22 12:24:24 UTC • Stars: 1

CVE-2021-36934 PowerShell Fix

n3tsurge/CVE-2021-36934

Type: github • Created: 2021-07-21 17:24:44 UTC • Stars: 5

Detection and Mitigation script for CVE-2021-36934 (HiveNightmare aka. SeriousSam)

JoranSlingerland/CVE-2021-36934

Type: github • Created: 2021-07-21 13:06:51 UTC • Stars: 10

Fix for the CVE-2021-36934