Is CVE-2021-34527 being actively exploited?

Yes. CVE-2021-34527 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on November 3, 2021.

What is the CVSS score for CVE-2021-34527?

CVE-2021-34527 has a CVSS 3.1 base score of 8.8 (HIGH).

CVE-2021-34527

HIGH · CVSS 8.8CISA KEV: actively exploitedEPSS 99.8%EU EUVD: exploited

A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. UPDATE July 7, 2021: The security update for Windows Server 2012, Windows Server 2016 and Windows 10, Version 1607 have been released. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. If you are unable to install these updates, see the FAQ and Workaround sections in this CVE for information on how to help protect your system from this vulnerability. In addition to installing the updates, in order to secure your system, you must confirm that the following registry settings are set to 0 (zero) or are not defined (Note: These registry keys do not exist by default, and therefore are already at the secure setting.), also that your Group Policy setting are correct (see FAQ): HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint NoWarningNoElevationOnInstall = 0 (DWORD) or not defined (default setting) UpdatePromptSettings = 0 (DWORD) or not defined (default setting) Having NoWarningNoElevationOnInstall set to 1 makes your system vulnerable by design. UPDATE July 6, 2021: Microsoft has completed the investigation and has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. If you are unable to install these updates, see the FAQ and Workaround sections in this CVE for information on how to help protect your system from this vulnerability. See also KB5005010: Restricting installation of new printer drivers after applying the July 6, 2021 updates. Note that the security updates released on and after July 6, 2021 contain protections for CVE-2021-1675 and the additional remote code execution exploit in the Windows Print Spooler service known as “PrintNightmare”, documented in CVE-2021-34527.

Key facts

CVSS score: 8.8 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS score: 99.8% (100th percentile)
In CISA KEV: Yes, added November 3, 2021
In EU EUVD: Yes (EUVD-2021-21181)
Published: July 2, 2021
NVD last modified: August 10, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Microsoft Windows Print Spooler Remote Code Execution Vulnerability

Added to the KEV catalog on November 3, 2021; federal remediation due May 3, 2022. Known to be used in ransomware campaigns.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2021-21181 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on August 10, 2026.

View on the EU Vulnerability Database

Affected products

microsoft / windows 10 1507
microsoft / windows 10 1607
microsoft / windows 10 1809
microsoft / windows 10 20h2
microsoft / windows 10 21h2
microsoft / windows 10 22h2
microsoft / windows 11 21h2
microsoft / windows 11 22h2
microsoft / windows rt 8.1
microsoft / windows server 2008
microsoft / windows server 2008
microsoft / windows server 2012
microsoft / windows server 2012
microsoft / windows server 2016
microsoft / windows server 2019
microsoft / windows server 2022
microsoft / windows server 20h2

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

Microsoft Windows 10 and Server version 1903 (May 2019 Update) - Microsoft Corporation - Common Criteria 2019-22-INF-2839 - archived

References

http://packetstormsecurity.com/files/167261/Print-Spooler-Remote-DLL-Injection.html(Exploit, Third Party Advisory, VDB Entry)
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527(Patch, Vendor Advisory)
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527(Mitigation, Patch, Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34527(US Government Resource)
https://www.kb.cert.org/vuls/id/383432(Third Party Advisory, US Government Resource)
https://www.vicarius.io/vsociety/posts/cve-2021-34527-printnightmare-detection-script(Exploit, Third Party Advisory)
https://www.vicarius.io/vsociety/posts/cve-2021-34527-printnightmare-mitigation-script(Exploit, Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain