---
id: "CVE-2021-36934"
kind: "vulnerability"
aliases: ["CVE-2021-36934"]
title: "Microsoft Windows: Microsoft Windows SAM Local Privilege Escalation Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.67252
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Windows", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "multi-user-hosts", "windows", "windows-server"]
not_affected_if: ["no-volume-shadow-copies", "patched-windows"]
published_at: "2021-07-22T07:15:11+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36934", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-36934", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36934", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Windows: Microsoft Windows SAM Local Privilege Escalation Vulnerability

Windows lets local users read the SAM registry hive from a Volume Shadow Copy of the system drive when one exists. Any local user can use that to obtain credential hashes and escalate to SYSTEM.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Windows affected ? fixed ?

## How to check

Run 'vssadmin list shadows' on the machine and check whether a shadow copy of the system drive exists.
Compare the installed Windows build against Microsoft's CVE-2021-36934 advisory (Windows 10 and Server builds from 2021).

## Fix

Install the Microsoft security update for CVE-2021-36934 for your Windows version, as the CISA entry directs.
If patching is delayed, delete existing shadow copies and restrict access to the SAM file per Microsoft guidance; unknown for exact commands.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36934
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-36934
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-36934

## From the sources

An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
An attacker must have the ability to execute code on a victim system to exploit this vulnerability.
After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_