Actively exploited · CISA KEV · NVD published 2021-07-22
Actively exploitedCVE-2021-36934
An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.
- First PoC
- same day →Metasploit
- 395 days →First cited attacker
Signals
- Exploited in the wild
- Yesadded 2022-02-10 · due 2022-02-24. An observation, not a forecast.
- EPSS · 30-day forecast
- 67%Chance of exploitation in the next 30 days, 99th percentile of all CVEs. A forecast; KEV outranks it.
- CVSS · NVD · HIGH
- 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Internet exposure
- not stated by sourcesNo exposure census on this CVE's dispatches.
Exploits
1 known · links onlyMetasploit1
Due to mismanagement of SAM and SYSTEM hives in Windows 10, it is possible for an unprivileged user to read those files. But, as they are locked while Windows is running we are not able to read them directly. The trick is to take advantage of Volume Shadow Copy, which is generally enabled, to finally have a read access. Once SAM and SYSTEM files are successfully dumped and stored in `store_loot`, you can dump the hashes with some external scripts like secr
ruby · seen 2026-10-18
On the wire
0 dispatchesNo dispatch on our wire has named this CVE yet.
Watch this one?
KEV additions reach Telegram and the KEV-only RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.