Attackers exploiting zero-day vulnerability in Windows Installer — Here’s what you need to know and Talos’ coverage
Summary: Cisco Talos is releasing new Snort rules for a zero-day elevation-of-privilege flaw in Microsoft Windows Installer that lets an attacker with a limited user account become an administrator, and it affects every version of Windows including fully patched Windows 11 and Server 2022. Microsoft's Nov. 9 update was meant to fix CVE-2021-41379 but was insufficient, and researcher Abdelhamid Naceri published proof-of-concept exploit code on GitHub on Nov. 22 that works despite the fixes, with no patch available as of the blog's publication.
Why it matters: The flaw was scored medium at a base CVSS of 5.5, but functional exploit code is now public and Talos has already detected malware samples in the wild attempting to use it, so the practical risk is higher than the score suggests.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2021-41379CVE-2026-20127
- Related
- Threat Advisory: Atlassian Confluence zero-day vulnerability under active exploitation Cyber Risks ·Active exploitation of Cisco Catalyst SD-WAN by UAT-8616 Cyber Risks ·Inside Key Drift: Analyzing historical UAT-11473 activity on Cisco SD-WAN Cyber Risks · Oct 28, 2026