Skip to content
Fencer Vulns
high 7.8

CVE-2021-36934 kev in the critical feed json

Windows Elevation of Privilege Vulnerability

published 2021-07-22 5 y ago modified 2026-08-10 2 mo ago also EUVD-2021-23510

cvss
7.8
version 3.1, CNA
cisa kev
Exploited
added 2022-02-10
epss
67.3%
EPSS 67.3% chance of exploitation in 30 days, percentile 99.3%
public exploits
1
Metasploit

Summary

An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • Microsoft Windows 10 Version 1809 10.0.17763.2114
  • Microsoft Windows 10 Version 1909 10.0.18363.1734
  • Microsoft Windows 10 Version 2004 10.0.19041.1165
  • Microsoft Windows 10 Version 20H2 10.0.19042.1165
  • Microsoft Windows 10 Version 21H1 10.0.19043.1165

Timeline

  1. First public exploit (Metasploit post/windows/gather/credentials/windows_sam_hivenightmare)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
4 y ago
Patch by
2022-02-24 (4 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
Microsoft, Windows
CISA name
Microsoft Windows SAM Local Privilege Escalation Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1078 Valid Accounts exploitation
  • T1068 Exploitation for Privilege Escalation primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
21 mo ago

Exploit prediction

67.25% chance of exploitation in the next 30 days, higher than 99.3% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:T/RC:C
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • Microsoft Windows 10 Version 1809
  • Microsoft Windows 10 Version 1909
  • Microsoft Windows 10 Version 2004
  • Microsoft Windows 10 Version 20H2
  • Microsoft Windows 10 Version 21H1

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.