{"id":"CVE-2021-34484","published":"2021-08-12T18:15:09Z","modified":"2026-08-10T19:59:12Z","title":"Microsoft Windows User Profile Service Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"Windows User Profile Service Elevation of Privilege Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"A privilege escalation flaw exists in the User Profile Service component of Microsoft Windows, which allows an attacker to elevate their privileges on the affected system. An attacker with local access and low-privileged credentials can exploit it without any user interaction, gaining high impact to confidentiality, integrity and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:13:21Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.21827,"percentile":0.97642,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2022-03-31","dueDate":"2022-04-21","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-34484","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-03-28","exploitedFirstSeen":"2022-03-28","ransomware":false,"evidence":[{"url":"https://twitter.com/billdemirkapi/status/1508527492285575172","date":"2022-03-28"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-31"},{"url":"https://security.packt.com/how-lapsus-breached-okta-and-why-you-should-test-your-own-capabilities/","date":"2022-04-05"},{"url":"https://www.cisa.gov/sites/default/files/2023-08/CSRB_Lapsus%24_508c.pdf","date":"2023-08-10"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34484","tags":["Patch","Vendor Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34484","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34484","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Local privilege escalation via profile service flaw","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Windows User Profile Service Elevation of Privilege Vulnerability","start":0,"end":65}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-21139","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-21139","exploited":true,"exploitedSince":"2022-03-31","provenance":"source"},"exploits":[],"exploitSources":null,"detections":{"cveRules":[{"title":"Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE","id":"52a85084-6989-40c3-8f32-091e12e17692","level":"low","status":"test","path":"rules-emerging-threats/2022/Exploits/CVE-2022-21919/win_system_exploit_cve_2022_21919_or_cve_2021_34484.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-21919/win_system_exploit_cve_2022_21919_or_cve_2021_34484.yml","techniques":[]}]},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"}],"timeline":[{"date":"2021-08-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34484","provenance":"source"},{"date":"2022-03-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://twitter.com/billdemirkapi/status/1508527492285575172","provenance":"source"},{"date":"2022-03-31","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-31","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-21139","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":231},"priority":{"score":60.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1679 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.53,"detail":"percentile 0.9764"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-269"}}