CVE-2021-36934

mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.673 · 99 %ileexploit · functionalEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 25 exploits · functional

Likely / severe?

67.3% (99th) EPSS

CVSS 4.6 · medium

Is it mine?

47 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · msrc_csaf

added 2022-02-10remediate by 2022-02-24

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-26

Microsoft Windows SAM Local Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedWindows 10 Version 1809 for 32-bit Systemsmsrc_csaf
10.0.17763.2114:Security Update:https://support.microsoft.com/help/5005030
https://support.microsoft.com/help/5005030
FixedWindows 10 Version 1809 for ARM64-based Systemsmsrc_csaf
10.0.17763.2114:Security Update:https://support.microsoft.com/help/5005030
https://support.microsoft.com/help/5005030
FixedWindows 10 Version 1809 for x64-based Systemsmsrc_csaf
10.0.17763.2114:Security Update:https://support.microsoft.com/help/5005030
https://support.microsoft.com/help/5005030
FixedWindows 10 Version 1909 for 32-bit Systemsmsrc_csaf
10.0.18363.1734:Security Update:https://support.microsoft.com/help/5005031
https://support.microsoft.com/help/5005031
FixedWindows 10 Version 1909 for ARM64-based Systemsmsrc_csaf
10.0.18363.1734:Security Update:https://support.microsoft.com/help/5005031
https://support.microsoft.com/help/5005031
FixedWindows 10 Version 1909 for x64-based Systemsmsrc_csaf
10.0.18363.1734:Security Update:https://support.microsoft.com/help/5005031
https://support.microsoft.com/help/5005031
FixedWindows 10 Version 2004 for 32-bit Systemsmsrc_csaf
10.0.19041.1165:Security Update:https://support.microsoft.com/help/5005033
https://support.microsoft.com/help/5005033
FixedWindows 10 Version 2004 for ARM64-based Systemsmsrc_csaf
10.0.19041.1165:Security Update:https://support.microsoft.com/help/5005033
https://support.microsoft.com/help/5005033
FixedWindows 10 Version 2004 for x64-based Systemsmsrc_csaf
10.0.19041.1165:Security Update:https://support.microsoft.com/help/5005033
https://support.microsoft.com/help/5005033
FixedWindows 10 Version 20H2 for 32-bit Systemsmsrc_csaf
10.0.19042.1165:Security Update:https://support.microsoft.com/help/5005033
https://support.microsoft.com/help/5005033
FixedWindows 10 Version 20H2 for ARM64-based Systemsmsrc_csaf
10.0.19042.1165:Security Update:https://support.microsoft.com/help/5005033
https://support.microsoft.com/help/5005033
FixedWindows 10 Version 21H1 for 32-bit Systemsmsrc_csaf
10.0.19043.1165:Security Update:https://support.microsoft.com/help/5005033
https://support.microsoft.com/help/5005033
FixedWindows 10 Version 21H1 for ARM64-based Systemsmsrc_csaf
10.0.19043.1165:Security Update:https://support.microsoft.com/help/5005033
https://support.microsoft.com/help/5005033
FixedWindows 10 Version 21H1 for x64-based Systemsmsrc_csaf
10.0.19043.1165:Security Update:https://support.microsoft.com/help/5005033
https://support.microsoft.com/help/5005033

cvss

Technical severity, 0–10. One row per scoring source.

9.3

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 4.6–9.3

v2.04.6mediumAV:L/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 3.9 · impact 6.4

v2.04.6mediumAV:L/AC:L/Au:N/C:P/I:P/A:P/E:Hsecondary · CVSS-BT (t0sche)

v3.19.3criticalAV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · secure@microsoft.com USexploitability 1.8 · impact 5.9

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:T/RC:Csecondary · Microsoft Security Response Center US

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:T/RC:Csecondary · ENISA EU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · NVD / NIST USexploitability 1.8 · impact 5.9

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-264US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (25)

Public proof-of-concept and weaponised exploit code.

post/windows/gather/credentials/windows_sam_hivenightmareWindows SAM secrets leak - HiveNightmarefunctional · metasploit
0x0D1n/CVE-2021-369340x0D1n/CVE-2021-36934PoC · poc_in_github
DuyDuongDuyDuong/CVE-2021-36934-DLL-Hijacking-DFIR-InvestigationDuyDuongDuyDuong/CVE-2021-36934-DLL-Hijacking-DFIR-InvestigationPoC · poc_in_github
HuskyHacks/ShadowStealPure Nim implementation for exploiting CVE-2021-36934, the SeriousSAM local privilege escalationPoC · poc_in_github
JoranSlingerland/CVE-2021-36934Fix for the CVE-2021-36934PoC · poc_in_github
OlivierLaflamme/CVE-2021-36934-export-shadow-volume-POCOlivierLaflamme/CVE-2021-36934-export-shadow-volume-POCPoC · poc_in_github

affected products (47)

Products and version ranges known to be affected.

Microsoft Windows 10 Version 180910.0.0 → 10.0.17763.2114enisa_euvdEU
Microsoft Windows 10 Version 180910.0.17763.0 → 10.0.17763.2114enisa_euvdEU
Microsoft Windows 10 Version 190910.0.0 → 10.0.18363.1734enisa_euvdEU
Microsoft Windows 10 Version 200410.0.0 → 10.0.19041.1165enisa_euvdEU
Microsoft Windows 10 Version 20H210.0.0 → 10.0.19042.1165enisa_euvdEU
Microsoft Windows 10 Version 21H110.0.0 → 10.0.19043.1165enisa_euvdEU
Microsoft Corp Windows 10 1809all versionsfstec_bduRU
Microsoft Corp Windows 10 1909all versionsfstec_bduRU
Microsoft Corp Windows 10 2004all versionsfstec_bduRU
Microsoft Corp Windows 10 20H2all versionsfstec_bduRU
Microsoft Corp Windows 10 21H1all versionsfstec_bduRU
Microsoft Corp Windows Server 2004 (Server Core Installation)all versionsfstec_bduRU
Microsoft Corp Windows Server 2019all versionsfstec_bduRU
Microsoft Corp Windows Server 2019 (Server Core installation)all versionsfstec_bduRU
Windows 10 Version 1809 for 32-bit Systemsall versionsfixedmsrc_csafUS
Windows 10 Version 1809 for 32-bit Systems< 10.0.17763.2114msrc_csafUS
Windows 10 Version 1809 for ARM64-based Systemsall versionsfixedmsrc_csafUS
Windows 10 Version 1809 for ARM64-based Systems< 10.0.17763.2114msrc_csafUS
Windows 10 Version 1809 for x64-based Systemsall versionsfixedmsrc_csafUS
Windows 10 Version 1809 for x64-based Systems< 10.0.17763.2114msrc_csafUS

showing 20 of 47

advisories (1)

Vendor and ecosystem advisories describing this.

msrc_CVE-2021-36934Windows Elevation of Privilege Vulnerability2021-07-20csaf · msrc_csafUS
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu msrc_csaf NVD CVE.org MITRE

published 2021-07-22modified 2026-08-10

references (15)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan