Type Vulnerability
Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.
Microsoft · Privilege escalation
Microsoft Windows Privilege Escalation Vulnerability
CVE-2021-43226
What this means
This is rated high severity (7.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Microsoft Windows 10 1507, Microsoft Windows 10 1607 and Microsoft Windows 10 1809, and 16 more are in your estate, and treat that as the priority.
Full vendor description
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Scoring and exploitation
7.8/ 10
CVSS 3.1 base scoreHigh
Exploitable only with local access and a low-privilege account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Attack vectorLocalAV:L
Attack complexityLowAC:L
Privileges requiredLowPR:L
User interactionNoneUI:N
ScopeUnchangedS:U
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
- ~3.3% estimated chance of attack in 30 daysModel estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Known
- Listed product
- Microsoft Windows
Weaknesses
NVD-CWE-noinfo
Affected products ()
- Microsoft Windows 10 1507
- Microsoft Windows 10 1607
- Microsoft Windows 10 1809
- Microsoft Windows 10 1909
- Microsoft Windows 10 2004
- Microsoft Windows 10 20h2
- Microsoft Windows 10 21h1
- Microsoft Windows 10 21h2
- Microsoft Windows 11 21h2
- Microsoft Windows 7
- Microsoft Windows 8.1
- Microsoft Windows Rt 8.1
- Microsoft Windows Server 2004
- Microsoft Windows Server 2008
- Microsoft Windows Server 2012
- Microsoft Windows Server 2016
- Microsoft Windows Server 2019
- Microsoft Windows Server 2022
- Microsoft Windows Server 20h2
Show the raw CPE strings (25)
- cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:arm64:*
- cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*
- cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*
References
3 links from the CVE record, grouped by site; the vendor's advisory comes first.
portal.msrc.microsoft.com1 linkVendor advisory
- CVE-2021-43226 (opens in a new tab)Patch · Vendor Advisory
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource