Microsoft Windows Print Spooler RCE Vulnerability (Print Nightmare-CVE-2021-34527) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR® | Qualys

Summary: On June 29, 2021, a zero-day exploit was observed on Microsoft Windows systems that lets an authenticated user with a regular Domain User account gain full SYSTEM-level privileges, and Microsoft linked it to CVE-2021-34527 as a confirmed remote code execution vulnerability on July 1, 2021. Microsoft released patches on July 6, 2021, but researchers Matthew Hickey and Will Dormann found the fixes addressed only the remote code execution component, leaving local privilege escalation exploitable on older Windows versions and on newer versions where the Point and Print policy was enabled.
Why it matters: The Print Spooler service runs by default on all Windows servers and clients, including domain controllers, so a single regular user account was enough to take over a domain controller - and the first round of patches left the local privilege escalation path open.

Read the original at Qualys Blog ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2021-34527
Related: CVE-2021-34527: Microsoft Windows Print Spooler Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Microsoft Issues Emergency Patch for Windows Flaw Cyber Risks ·
Microsoft Patch Tuesday, July 2021 Edition Cyber Risks ·