Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2021-36934

Summary
Assigner-microsoft
Assigner Org ID-f38d906d-7342-40ea-92c1-6c4a2c6478c8
Published At-22 Jul, 2021 | 07:05
Updated At-30 Jul, 2025 | 01:38
Rejected At-
Credits

Microsoft Windows SAM Local Privilege Escalation Vulnerability

If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Known Exploited Vulnerabilities (KEV)
cisa.gov
Vendor:
Microsoft CorporationMicrosoft
Product:Windows
Added At:10 Feb, 2022
Due At:24 Feb, 2022

Microsoft Windows SAM Local Privilege Escalation Vulnerability

If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.

Used in Ransomware

:

Unknown

CWE

:
CWE-1220

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://nvd.nist.gov/vuln/detail/CVE-2021-36934
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:microsoft
Assigner Org ID:f38d906d-7342-40ea-92c1-6c4a2c6478c8
Published At:22 Jul, 2021 | 07:05
Updated At:30 Jul, 2025 | 01:38
Rejected At:
▼CVE Numbering Authority (CNA)
Windows Elevation of Privilege Vulnerability

<p>An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker must have the ability to execute code on a victim system to exploit this vulnerability.</p> <p>After installing this security update, you <em>must</em> manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. <strong>Simply installing this security update will not fully mitigate this vulnerability.</strong> See <a href="https://support.microsoft.com/topic/1ceaa637-aaa3-4b58-a48b-baf72a2fa9e7">KB5005357- Delete Volume Shadow Copies</a>.</p>

Affected Products
Vendor
Microsoft CorporationMicrosoft
Product
Windows 10 Version 1809
CPEs
  • cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2114:*:*:*:*:*:x86:*
  • cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2114:*:*:*:*:*:x64:*
  • cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2114:*:*:*:*:*:arm64:*
Platforms
  • 32-bit Systems
  • x64-based Systems
  • ARM64-based Systems
Versions
Affected
  • From 10.0.0 before 10.0.17763.2114 (custom)
Vendor
Microsoft CorporationMicrosoft
Product
Windows 10 Version 1909
CPEs
  • cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1734:*:*:*:*:*:x86:*
  • cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1734:*:*:*:*:*:x64:*
  • cpe:2.3:o:microsoft:windows_10_1809:10.0.18363.1734:*:*:*:*:*:x64:*
Platforms
  • 32-bit Systems
  • x64-based Systems
  • ARM64-based Systems
Versions
Affected
  • From 10.0.0 before 10.0.18363.1734 (custom)
Vendor
Microsoft CorporationMicrosoft
Product
Windows 10 Version 21H1
CPEs
  • cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1165:*:*:*:*:*:x64:*
  • cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1165:*:*:*:*:*:arm64:*
  • cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1165:*:*:*:*:*:x86:*
Platforms
  • x64-based Systems
  • ARM64-based Systems
  • 32-bit Systems
Versions
Affected
  • From 10.0.0 before 10.0.19043.1165 (custom)
Vendor
Microsoft CorporationMicrosoft
Product
Windows 10 Version 2004
CPEs
  • cpe:2.3:o:microsoft:windows_10_1809:10.0.19041.1165:*:*:*:*:*:x64:*
Platforms
  • 32-bit Systems
  • ARM64-based Systems
  • x64-based Systems
Versions
Affected
  • From 10.0.0 before 10.0.19041.1165 (custom)
Vendor
Microsoft CorporationMicrosoft
Product
Windows 10 Version 20H2
CPEs
  • cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1165:*:*:*:*:*:x86:*
  • cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1165:*:*:*:*:*:arm64:*
Platforms
  • 32-bit Systems
  • ARM64-based Systems
Versions
Affected
  • From 10.0.0 before 10.0.19042.1165 (custom)
Problem Types
TypeCWE IDDescription
ImpactN/AElevation of Privilege
Type: Impact
CWE ID: N/A
Description: Elevation of Privilege
Metrics
VersionBase scoreBase severityVector
3.17.8HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:T/RC:C
Version: 3.1
Base score: 7.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:T/RC:C
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934
x_refsource_MISC
http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.html
x_refsource_MISC
Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934
Resource:
x_refsource_MISC
Hyperlink: http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.html
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
1. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://www.kb.cert.org/vuls/id/506989
N/A
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934
x_refsource_MISC
x_transferred
http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.html
x_refsource_MISC
x_transferred
Hyperlink: https://www.kb.cert.org/vuls/id/506989
Resource: N/A
Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934
Resource:
x_refsource_MISC
x_transferred
Hyperlink: http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.html
Resource:
x_refsource_MISC
x_transferred
2. CISA ADP Vulnrichment
Affected Products
Problem Types
TypeCWE IDDescription
CWECWE-noinfoCWE-noinfo Not enough information
Type: CWE
CWE ID: CWE-noinfo
Description: CWE-noinfo Not enough information
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
kev
dateAdded:
2022-02-10
reference:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36934
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
CVE-2021-36934 added to CISA KEV2022-02-10 00:00:00
Event: CVE-2021-36934 added to CISA KEV
Date: 2022-02-10 00:00:00
Replaced By

Rejected Reason

References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:secure@microsoft.com
Published At:22 Jul, 2021 | 07:15
Updated At:07 Mar, 2025 | 21:54

<p>An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker must have the ability to execute code on a victim system to exploit this vulnerability.</p> <p>After installing this security update, you <em>must</em> manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. <strong>Simply installing this security update will not fully mitigate this vulnerability.</strong> See <a href="https://support.microsoft.com/topic/1ceaa637-aaa3-4b58-a48b-baf72a2fa9e7">KB5005357- Delete Volume Shadow Copies</a>.</p>

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
2022-02-102022-02-24Microsoft Windows SAM Local Privilege Escalation VulnerabilityApply updates per vendor instructions.
Date Added: 2022-02-10
Due Date: 2022-02-24
Vulnerability Name: Microsoft Windows SAM Local Privilege Escalation Vulnerability
Required Action: Apply updates per vendor instructions.
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.17.8HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Secondary3.17.8HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary2.04.6MEDIUM
AV:L/AC:L/Au:N/C:P/I:P/A:P
Type: Secondary
Version: 3.1
Base score: 7.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 7.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Type: Primary
Version: 2.0
Base score: 4.6
Base severity: MEDIUM
Vector:
AV:L/AC:L/Au:N/C:P/I:P/A:P
CPE Matches

Microsoft Corporation
microsoft
>>windows_10_1809>>Versions before 10.0.17763.2114(exclusive)
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*
Microsoft Corporation
microsoft
>>windows_10_1909>>Versions before 10.0.18363.1734(exclusive)
cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*
Microsoft Corporation
microsoft
>>windows_10_2004>>Versions before 10.0.19041.1165(exclusive)
cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*
Microsoft Corporation
microsoft
>>windows_10_20h2>>Versions before 10.0.19042.1165(exclusive)
cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*
Microsoft Corporation
microsoft
>>windows_10_21h1>>Versions before 10.0.19043.1165(exclusive)
cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
NVD-CWE-OtherPrimarynvd@nist.gov
CWE ID: NVD-CWE-Other
Type: Primary
Source: nvd@nist.gov
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.htmlsecure@microsoft.com
Third Party Advisory
VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934secure@microsoft.com
Patch
Vendor Advisory
http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.htmlaf854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934af854a3a-2127-422b-91ae-364da2661108
Patch
Vendor Advisory
https://www.kb.cert.org/vuls/id/506989af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Hyperlink: http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.html
Source: secure@microsoft.com
Resource:
Third Party Advisory
VDB Entry
Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934
Source: secure@microsoft.com
Resource:
Patch
Vendor Advisory
Hyperlink: http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Third Party Advisory
VDB Entry
Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Patch
Vendor Advisory
Hyperlink: https://www.kb.cert.org/vuls/id/506989
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Third Party Advisory

Change History

0
Information is not available yet

Similar CVEs

0Records found

Details not found