CVE-2021-28310

What it actually does

CVE-2021-28310 is a local Windows Win32k memory-corruption elevation-of-privilege vulnerability. An attacker who already has the ability to run code as a low-privileged user can trigger the flaw in the Windows kernel-mode graphics/windowing subsystem to corrupt memory and execute code with elevated privileges, typically SYSTEM or kernel-level privileges. It does not provide initial remote access by itself, but it is highly valuable as a second-stage exploit after phishing, malware execution, credential theft, or compromise of a low-privileged account. Successful exploitation can give the attacker full control over the affected Windows host, including the ability to disable security controls, dump credentials, tamper with files, install persistence, and move laterally.

Why it matters to the business

This vulnerability can turn a limited endpoint compromise into full device compromise. Because it is listed in CISA KEV and has confirmed in-the-wild exploitation, organizations should treat unpatched affected Windows 10 and Windows Server systems as high-priority exposure, even though the EPSS score is moderate and stable. Operational consequences include endpoint takeover, credential compromise, security tool tampering, persistence, lateral movement, and potential escalation of broader intrusion campaigns. The CISA KEV remediation deadline was 2021-11-17, so any remaining exposure is significantly overdue.

How an attack unfolds

An attacker first obtains local code execution on an affected Windows system, commonly through phishing, malware delivery, exploitation of another vulnerability, stolen credentials, or abuse of remote access. The attacker then runs a purpose-built local exploit that interacts with the Win32k subsystem and triggers the memory-corruption condition. If successful, the exploit escapes the attacker’s low-privileged context and gains elevated execution, usually as SYSTEM or with kernel-level capabilities. The attacker can then deploy additional tooling, disable or evade endpoint defenses, dump credentials from memory or the registry, create persistence, access protected data, and use the host as a foothold for lateral movement. Public reporting and KEV inclusion indicate this vulnerability has been exploited in real attacks, so detection should focus both on patch status and on post-exploitation behavior following suspicious local privilege escalation.

How to fix it

Apply the Microsoft security updates released for CVE-2021-28310, originally addressed in the April 2021 Patch Tuesday updates, to all affected Windows 10 and Windows Server versions: Windows 10 1803, 1809, 1909, 2004, 20H2; Windows Server 1909, 2004, 2019, and 20H2. Because no product-specific fixed build numbers were provided in the input, use Microsoft’s official Security Update Guide and Windows Update/WSUS/ConfigMgr compliance data to identify the correct cumulative update or later superseding cumulative update for each OS release. Systems on unsupported Windows releases should be upgraded to a supported release and fully patched. Where immediate patching is not possible, reduce exposure by restricting interactive logon, removing unnecessary local admin rights, enforcing application control, enabling endpoint protection, blocking untrusted script/executable execution, and isolating high-risk systems. Mitigations do not fully replace patching because this is a local kernel privilege-escalation flaw.

How to confirm the fix worked

Confirm that each affected system has installed the April 2021 Windows cumulative security update or a later superseding cumulative update applicable to its Windows version. Validate through Windows Update history, WSUS/ConfigMgr/Intune compliance reports, vulnerability scanner plugin results, and OS build/KB inventory. Confirm the OS version is still supported and receiving cumulative updates. Re-scan after patch deployment and verify the vulnerability is no longer reported. For defense validation, attempt to reproduce only in an authorized test environment using a benign privilege-escalation check or vendor-supported scanner; do not run exploit code on production systems. Also validate that standard users cannot write to protected locations, create privileged services, disable endpoint protection, or obtain SYSTEM shells through unauthorized tools.

Typical attack path

1. Gain initial access to an affected Windows 10 or Windows Server system through malware, phishing, exposed remote access, stolen credentials, or another exploit.
2. Execute code locally under a low-privileged or constrained user context.
3. Run a Win32k local privilege-escalation exploit targeting the vulnerable Windows build.
4. Trigger memory corruption in the kernel-mode windowing/graphics subsystem.
5. Obtain elevated privileges, commonly SYSTEM-level execution.
6. Disable security tooling, modify protected system settings, or inject into trusted processes.
7. Dump credentials, access sensitive files, install persistence, and move laterally to other systems.

How to detect it

Detection should focus on signs that a local privilege-escalation exploit was used and on follow-on activity, because exploitation may not leave a unique, reliable network indicator. Review EDR telemetry, Sysmon, Windows Security logs, Windows Defender logs, PowerShell logs, Windows Error Reporting, and application crash logs from affected or previously unpatched systems. Look for low-privileged user processes spawning elevated SYSTEM shells or administrative utilities, unusual child processes from user-writable paths, creation of services or scheduled tasks shortly after suspicious user execution, credential dumping attempts, access to LSASS, registry hive dumping, security product tampering, and unexpected crashes involving Win32k-related kernel components. Useful Windows events include process creation events such as Security 4688 or Sysmon Event ID 1, service creation events such as Security 4697 or System 7045, scheduled task creation events such as Security 4698, special privilege assignment such as Security 4672, explicit credential use such as Security 4648, logon activity such as 4624, and audit policy or security control changes such as 4719 and 4739. Investigate Windows Error Reporting entries, bugchecks, or application crashes referencing win32k.sys, win32kfull.sys, win32kbase.sys, dwm.exe, or csrss.exe around the time of suspicious privilege changes. Because this vulnerability has known exploited status, historical hunting should cover the period before patch installation, especially endpoints with malware detections or suspicious local execution.

• win32k.sys
• win32kfull.sys
• win32kbase.sys
• dwm.exe
• csrss.exe
• Security Event ID 4688
• Security Event ID 4672
• Security Event ID 4697
• Security Event ID 4698
• System Event ID 7045
• Sysmon Event ID 1
• Sysmon Event ID 10
• Sysmon Event ID 11
• Sysmon Event ID 12
• Sysmon Event ID 13
• Sysmon Event ID 14
• Windows Error Reporting
• Faulting module name: win32k.sys
• Faulting module name: win32kfull.sys
• Faulting module name: win32kbase.sys
• C:\Windows\System32\config\SAM
• C:\Windows\System32\config\SYSTEM
• C:\Windows\System32\config\SECURITY
• lsass.exe
• procdump.exe
• rundll32.exe comsvcs.dll, MiniDump
• reg save HKLM\SAM
• reg save HKLM\SYSTEM
• reg save HKLM\SECURITY
• sc.exe create
• schtasks.exe /Create
• wevtutil.exe cl
• vssadmin.exe delete shadows
• bcdedit.exe /set {default} safeboot

What your security team should do

• Prioritize remediation immediately for any remaining affected Windows systems because the vulnerability is in CISA KEV and has known in-the-wild exploitation; the KEV due date of 2021-11-17 is long past.
• Inventory Windows 10 and Windows Server assets matching the affected versions and verify they have the April 2021 cumulative update or a later superseding update installed.
• Prioritize internet-facing servers, jump hosts, VDI endpoints, administrator workstations, shared workstations, and systems where low-privileged users can execute code interactively.
• Hunt for evidence of post-exploitation behavior, especially suspicious SYSTEM-level process creation, credential dumping, security tool tampering, new services, scheduled tasks, and unexpected privilege changes.
• Correlate low-privileged user activity followed quickly by SYSTEM process execution, LSASS access, registry hive dumping, or lateral movement from the same host.
• Enforce least privilege, remove unnecessary local administrator rights, and restrict interactive logon to servers.
• Enable and monitor process creation logging, PowerShell logging, Windows Defender/EDR telemetry, service creation events, scheduled task events, and Windows Error Reporting crash telemetry.
• Use application control or attack surface reduction rules to reduce execution of untrusted binaries and scripts from user-writable paths.
• For systems that cannot be patched, isolate them, restrict user access, monitor aggressively, and create a retirement or upgrade plan.