Windows Elevation of Privilege Vulnerability
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- Fix
- Fixed in 10.0.17763.2114, 10.0.18363.1734, 10.0.19041.1165, 10.0.19042.1165, 10.0.19043.1165
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Microsoft Windows is affected, and an attacker who can run code on a system could gain full SYSTEM-level control, allowing them to install programs, access or alter data, and create new accounts. Installing the update alone does not fully fix the issue; administrators must also manually delete existing shadow copies of system files, including the SAM database.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Microsoft Windows 10 Version 1809
From 10.0.17763.0 · fixed in 10.0.17763.2114
- Microsoft Windows 10 Version 1809
From 10.0.0 · fixed in 10.0.17763.2114
- Microsoft Windows 10 Version 1909
From 10.0.0 · fixed in 10.0.18363.1734
- Microsoft Windows 10 Version 2004
From 10.0.0 · fixed in 10.0.19041.1165
- Microsoft Windows 10 Version 20H2
From 10.0.0 · fixed in 10.0.19042.1165
- Microsoft Windows 10 Version 21H1
From 10.0.0 · fixed in 10.0.19043.1165