CVE-2021-36934
An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.
Key facts
- CVSS score
- 7.8 (v3.1)
- Severity
- HIGH
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- EPSS score
- 67.3% (99th percentile)
- In CISA KEV
- Yes, added February 10, 2022
- In EU EUVD
- Yes (EUVD-2021-23510)
- Published
- July 22, 2021
- NVD last modified
- August 10, 2026
- Status
- Analyzed
CISA Known Exploited Vulnerability
Microsoft Windows SAM Local Privilege Escalation Vulnerability
Added to the KEV catalog on February 10, 2022; federal remediation due February 24, 2022.
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2021-23510 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on August 10, 2026.
View on the EU Vulnerability DatabaseAffected products
- microsoft / windows 10 1809
- microsoft / windows 10 1909
- microsoft / windows 10 2004
- microsoft / windows 10 20h2
- microsoft / windows 10 21h1
Certified products that may be affected
2 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- Microsoft Windows 10 version 2004 (May 2020 Update), Microsoft Windows Server version 2004 (May 2020 Update) and others - Microsoft Corporation - Common Criteria 2020-50-INF-3671 - active
- Microsoft Windows 10 version 1909 and Microsoft Windows Server version 1909 - Microsoft Corporation - Common Criteria 2019-47-INF-3134 - archived
References
- http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.html(Third Party Advisory, VDB Entry)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934(Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36934(US Government Resource)
- https://www.kb.cert.org/vuls/id/506989(Third Party Advisory)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain