CVE-2021-1675 KEVRansomwarePublic exploit High · 7.8 EPSS 85.3%

Microsoft Windows Print Spooler Remote Code Execution Vulnerability

Microsoft · Windows

Official description · NVD

Windows Print Spooler Remote Code Execution Vulnerability

Breakdown

86.1 / 100

Exploited: Yes, in CISA KEV
Reports: 3
Tactics: 1/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Trick a user into opening a fileT1204.002 · Malicious FileAI-written (claude-haiku-5-5)Medium confidence39 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterAI-written (claude-haiku-5-5)Medium confidence95 general detection rules

First seen exploited 2 months after disclosure. Public exploit code (Metasploit) was available the same day.

DisclosedPublic exploit codeMetasploit8 Jun 2021day 0
First seen exploitedVulnCheck KEV evidence10 Aug 2021+2 mo
Added to CISA KEVknown ransomware use; EU database agrees3 Nov 2021+5 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 5 cited passages 2

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

AI mapping from the description · primary impact

Remote code execution is the direct impact

Windows Print Spooler Remote Code Execution Vulnerability

From the official description (NVD) Original ↗

Malicious File T1204.002 Medium

AI mapping from the description · how it is exploited

Requires user interaction (UI:R) to trigger

Windows Print Spooler Remote Code Execution Vulnerability

From the official description (NVD) Original ↗

Lower-confidence links (3)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

Exploitation for Privilege EscalationT1068 machine-matched from report text
Exploit Public-Facing ApplicationT1190 needs user interaction; not a public-facing exploit
Exploitation of Remote ServicesT1210 needs user interaction; not a public-facing exploit

Detection

10 rules for this CVE · 134 general rules for its techniques

Rules for this CVE

10 that reference CVE-2021-1675 directly.

Antivirus PrinterNightmare CVE-2021-34527 Exploit Detectioncriticalstable
CVE-2021-1675 Print Spooler Exploitationcriticaltest
CVE-2021-1675 Print Spooler Exploitation Filename Patterncriticaltest
CVE-2021-1675 Print Spooler Exploitation IPC Accesscriticaltest
PrinterNightmare Mimikatz Driver Namecriticaltest
Possible CVE-2021-1675 Print Spooler Exploitationhightest
Potential PrintNightmare Exploitation Attempthightest
Suspicious Printer Driver Empty Manufacturerhightest
Possible PrintNightmare Print Driver Install - CVE-2021-1675mediumstable
Windows Spooler Service Suspicious Binary Loadinformationaltest

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Malicious FileT1204.00239 general rules

Droppers Exploiting CVE-2017-11882criticalstable
Ursnif Malware C2 URL Patterncriticalstable
Exploit for CVE-2017-8759criticaltest
Potential Maze Ransomware Activitycriticaltest
File With Uncommon Extension Created By An Office Applicationhightest
Flash Player Update from Suspicious Locationhightest
GAC DLL Loaded Via Office Applicationshightest
HackTool - LittleCorporal Generated Maldoc Injectionhightest

All 39 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 3 threat reports

3 reportsUnit 42Cisco TalosDragos

Reports are matched by finding the exact id CVE-2021-1675 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Unit 42Undated

Vice Society: Profiling a Persistent Threat to the Education Sector

Internet-facing applications and systems vulnerabilities can be exploited, such as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527), to gain initial access.

2 passages name itOriginal (opens in a new tab) ↗

Cisco TalosUndated

Vice Society leverages PrintNightmare in ransomware attacks

Brumaghin, Joe Marshall, and Arnaud Zobec.Executive SummaryAnother threat actor is actively exploiting the so-called PrintNightmare vulnerability (CVE-2021-1675 / CVE-2021-34527) in Windows' print spooler service to spread laterally across a victim's network as part of a recent ransomware attack, according to…

Original (opens in a new tab) ↗

DragosUndated

ICS/OT CYBERSECURITY

…was the same method to exploit Windows Print Spooler CVE-2021-1675 and thus was…

3 passages name itOriginal (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

INC and The Gentlemen Ransomware: Exposed AI Infrastructure28 Oct 2026
Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
44 more on OTX

References

6 links, grouped by NVD tag (5 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 3 Nov 2021. Federal due date 17 Nov 2021. Known ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 3 Nov 2021. EUVD-2021-7142

Public exploitAdvisories link exploit code.

, 30 Oct 2026

85.3%Top 0.28%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.72%).

3.1

7.8High · 7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 1908 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9972 19.9/20

Threat reports3 reports 7.7/10

Public exploit code1 NVD reference tagged Exploit; 2 NVD exploit links; 40 PoC-in-GitHub repos; 1 Metasploit module 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 7.8 5.5/7

End-of-life productsupported or unknown 0.0

Total86.1

Record

Published: 8 Jun 2021
Modified: 12 Aug 2026
: CWE-285 Improper Authorization
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

What security researchers reported

Vice Society: Profiling a Persistent Threat to the Education Sector

Vice Society leverages PrintNightmare in ransomware attacks

ICS/OT CYBERSECURITY

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

US Government Resource 2

Third Party Advisory 3

How attackers get in

What they do

techniques