{"id":"CVE-2021-41379","published":"2021-11-10T01:19:32Z","modified":"2026-08-19T19:22:46Z","title":"Microsoft Windows Installer Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"Windows Installer Elevation of Privilege Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an elevation of privilege vulnerability in the Windows Installer component of Microsoft Windows, rooted in improper link resolution before file access and insecure operations on Windows junctions or mount points. An attacker with local access and low-privileged credentials can exploit it without user interaction to elevate privileges, with the impact being high availability loss on the affected system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:04Z"},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.19452,"percentile":0.97362,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-17","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-41379","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-11-30","exploitedFirstSeen":"2021-11-30","ransomware":true,"evidence":[{"url":"https://www.rapid7.com/blog/post/2021/11/30/ongoing-exploitation-of-windows-installer-cve-2021-41379/","date":"2021-11-30"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-03"},{"url":"https://www.acronis.com/en/tru/posts/makop-ransomware-guloader-and-privilege-escalation-in-attacks-against-indian-businesses/","date":"2025-12-08"},{"url":"https://securelist.com/global-report-security-services-2026/119233/","date":"2026-03-25"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-59","name":"Improper Link Resolution Before File Access"},{"id":"CWE-1386","name":"Insecure Operation on Windows Junction / Mount Point"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41379","tags":["Patch","Vendor Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41379","tags":["Patch","Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-21-1308/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41379","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"exploitation_technique","evidence":[],"comment":"The vulnerability in Microsoft Windows allows local attackers to escalate privileges by exploiting a flaw in the Windows Installer service. By creating a junction, attackers can delete targeted files or directories, potentially executing arbitrary code with SYSTEM privileges. However, attackers must already have access and the ability to execute low-privileged code on the target system to exploit this vulnerability.\n\nThis vulnerability has been identified as exploited in the wild; however, specific details on how the vulnerability was exploited have not been publicly released. ","confidence":"high"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"primary_impact","evidence":[],"comment":"The vulnerability in Microsoft Windows allows local attackers to escalate privileges by exploiting a flaw in the Windows Installer service. By creating a junction, attackers can delete targeted files or directories, potentially executing arbitrary code with SYSTEM privileges. However, attackers must already have access and the ability to execute low-privileged code on the target system to exploit this vulnerability.\n\nThis vulnerability has been identified as exploited in the wild; however, specific details on how the vulnerability was exploited have not been publicly released. ","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-28407","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-28407","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[],"exploitSources":null,"detections":{"cveRules":[{"title":"Potential CVE-2021-41379 Exploitation Attempt","id":"af8bbce4-f751-46b4-8d91-82a33a736f61","level":"critical","status":"test","path":"rules-emerging-threats/2021/Exploits/CVE-2021-41379/proc_creation_win_exploit_cve_2021_41379.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-41379/proc_creation_win_exploit_cve_2021_41379.yml","techniques":["T1068"]}]},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"source"},{"stage":"primary","techniques":["T1068"],"provenance":"source"}],"timeline":[{"date":"2021-11-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41379","provenance":"source"},{"date":"2021-11-30","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.rapid7.com/blog/post/2021/11/30/ongoing-exploitation-of-windows-installer-cve-2021-41379/","provenance":"source"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-28407","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":113},"priority":{"score":71.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1794 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.47,"detail":"percentile 0.9736"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":3.85,"detail":"base score 5.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-59"}}