A flaw in the Windows Print Spooler allowed code execution with SYSTEM rights, including on domain controllers. Why the print service should be off where it is not needed.
Publicly disclosed: 1 July 2021
In late June 2021 researchers accidentally published exploit code for a Windows Print Spooler flaw. On 1 July Microsoft assigned CVE-2021-34527, known as PrintNightmare, and released emergency updates on 6 July. An authenticated user could run code with SYSTEM privileges — and because the Print Spooler runs by default on almost every Windows machine, including domain controllers, it was an easy way to take over a whole Windows domain.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2021-34527 | High, CVSS 8.8 (remote code execution, privilege escalation) | All supported Windows versions with Print Spooler running | Out-of-band update of 6 July 2021 and later updates |
Every service that runs but is not needed is an open window. Close the ones you do not use.
Sources: Microsoft CVE-2021-34527, NVD CVE-2021-34527.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
