{"id":"CVE-2021-36934","kind":"vulnerability","aliases":["CVE-2021-36934"],"related":[],"title":"Microsoft Windows: Microsoft Windows SAM Local Privilege Escalation Vulnerability","description":"An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\nAn attacker must have the ability to execute code on a victim system to exploit this vulnerability.\nAfter installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.","summary":"Windows lets local users read the SAM registry hive from a Volume Shadow Copy of the system drive when one exists. Any local user can use that to obtain credential hashes and escalate to SYSTEM.","severity":"high","cvss":7.8,"epss":0.67252,"exploited":true,"exploited_at":"2022-02-10T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","multi-user-hosts","windows","windows-server"],"not_affected_if":["no-volume-shadow-copies","patched-windows"],"how_to_check":"Run 'vssadmin list shadows' on the machine and check whether a shadow copy of the system drive exists.\nCompare the installed Windows build against Microsoft's CVE-2021-36934 advisory (Windows 10 and Server builds from 2021).","fix":"Install the Microsoft security update for CVE-2021-36934 for your Windows version, as the CISA entry directs.\nIf patching is delayed, delete existing shadow copies and restrict access to the SAM file per Microsoft guidance; unknown for exact commands.","status":"open","published_at":"2021-07-22T07:15:11+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:28:56+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:28:56Z","model":"claude-haiku-5-5","output":{"fix":"Install the Microsoft security update for CVE-2021-36934 for your Windows version, as the CISA entry directs.\nIf patching is delayed, delete existing shadow copies and restrict access to the SAM file per Microsoft guidance; unknown for exact commands.","reach":"local","impact":"high","summary":"Windows lets local users read the SAM registry hive from a Volume Shadow Copy of the system drive when one exists. Any local user can use that to obtain credential hashes and escalate to SYSTEM.","category":"infrastructure","who_cares":["windows","windows-server","multi-user-hosts"],"confidence":0.8,"needs_auth":"yes","worst_case":"Local user reads SAM hashes and escalates to SYSTEM","analyst_note":"Confirm the exact patched builds and the shadow-copy mitigation steps from Microsoft's advisory for CVE-2021-36934 (msrc.microsoft.com).","how_to_check":"Run 'vssadmin list shadows' on the machine and check whether a shadow copy of the system drive exists.\nCompare the installed Windows build against Microsoft's CVE-2021-36934 advisory (Windows 10 and Server builds from 2021).\nunknown","needs_analyst":true,"not_affected_if":["patched-windows","no-volume-shadow-copies"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000533,"input_tokens":2843,"output_tokens":497,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':11A,14A '-36934':12A,15A 'abil':126C 'access':73C 'account':84C,116C 'acl':76C 'arbitrari':97C 'attack':89C,103C,122C 'chang':109C 'code':98C,129C 'control':74C 'copi':41B,149C,178C 'could':95C,104C 'creat':114C 'credenti':57B 'cve':10A,13A 'data':112C 'databas':87C,156C 'delet':111C,146C,175C 'drive':45B 'elev':64C 'escal':8A,60B 'execut':128C 'exist':48B,68C 'exploit':18B,92C,135C 'file':80C,152C 'full':118C 'fulli':158C,169C 'hash':58B 'hive':36B 'host':23B 'includ':81C,153C 'infrastructur':19B 'instal':106C,139C,163C 'kb5005357':174C 'let':29B 'list':75C 'local':6A,30B,50B 'manag':85C 'manual':145C 'microsoft':1A,3A,16A 'mitig':159C,170C 'multi':21B 'multi-user-host':20B 'multipl':78C 'must':123C,144C 'new':115C 'obtain':56B 'one':47B 'over':71C 'permiss':72C 'privileg':7A,66C,101C 'program':107C 'read':32B 'registri':35B 'right':120C 'run':96C 'sam':5A,34B,86C,155C 'secur':83C,141C,165C 'see':173C 'server':27B 'shadow':40B,148C,177C 'simpli':162C 'success':91C 'system':44B,62B,79C,100C,133C,151C 'updat':142C,166C 'use':53B 'user':22B,31B,51B,119C 'victim':132C 'view':108C 'volum':39B,176C 'vulner':9A,67C,94C,137C,172C 'vulnerabilti':161C 'window':2A,4A,24B,26B,28B 'windows':17A 'windows-serv':25B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-07-22T07:15:11+00:00","kev":{"dateAdded":"2022-02-10","dueDate":"2022-02-24","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-36934","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36934","severity":null,"published_at":"2022-02-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:49+00:00","note":null},{"source":"epss","external_id":"CVE-2021-36934","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-36934","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-36934","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36934","severity":null,"published_at":"2021-07-22T07:15:11+00:00","modified_at":"2026-08-10T20:19:00+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}