CVE-2021-31199

What it actually does

CVE-2021-31199 is a local elevation-of-privilege vulnerability in the Microsoft Enhanced Cryptographic Provider on supported Windows client and server versions. An attacker who already has low-privileged local code execution can trigger the flaw to cross a privilege boundary and gain elevated rights, potentially allowing access to data or operations normally restricted from the compromised user context. The CVSS vector indicates local access, low attack complexity, low privileges required, no user interaction, and a scope change, making it most relevant as a post-compromise privilege escalation primitive rather than an initial remote entry point.

Why it matters to the business

If exploited, this vulnerability can turn an ordinary compromised Windows account into a more powerful foothold, increasing the likelihood of credential theft, persistence, lateral movement, security tool tampering, and broader compromise of Windows endpoints or servers. It is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation due date of 2021-11-17, meaning exploitation has been observed in the wild and long-unpatched systems should be treated as higher risk even though the standalone severity score is moderate.

How an attack unfolds

An attacker first obtains local execution on an affected Windows system through phishing, stolen credentials, malware, remote service abuse, or another vulnerability. From that low-privileged context, the attacker runs exploit code that abuses the Microsoft Enhanced Cryptographic Provider flaw to elevate privileges. Once elevated, the attacker can perform actions unavailable to the original account, such as accessing protected files, dumping credentials, disabling defenses, installing persistence, or using the host as a staging point for lateral movement. Because this is a local privilege escalation issue, it is commonly chained after initial access rather than used directly from the network.

How to fix it

Apply the Microsoft security updates released for CVE-2021-31199, originally addressed in the June 2021 Patch Tuesday updates, to all affected Windows client and server versions. Prioritize unsupported or long-lived systems such as Windows 7, Windows Server 2008, Windows Server 2012, Windows Server 2016, and Windows Server 2019 where compensating controls may be weaker. If immediate patching is not possible, reduce exposure by limiting interactive logon rights, removing unnecessary local administrator privileges, enforcing application control, restricting script and binary execution from user-writable locations, monitoring for privilege escalation behavior, and isolating high-value systems until patched. Systems that are no longer supported should be upgraded, enrolled in applicable extended security update programs where available, or retired.

How to confirm the fix worked

Confirm that each affected Windows asset has installed the Microsoft cumulative or security-only update that includes the June 2021 fix for its operating system version, or a later superseding cumulative update. Validate through enterprise patch management, Windows Update history, Microsoft Update Catalog package presence, or PowerShell queries such as Get-HotFix and OS build checks. For assurance, compare observed OS builds and installed KBs against Microsoft's official security update guidance for the specific Windows release. Vulnerability scanners should no longer report CVE-2021-31199 after the correct update is applied; investigate any exceptions, failed installs, stale scan data, or systems that are no longer receiving security updates.

Typical attack path

1. Gain initial access to a vulnerable Windows workstation or server using phishing, malware, exposed services, stolen credentials, or another exploit.
2. Establish low-privileged local code execution on the host.
3. Check the Windows version and patch level to determine whether the June 2021 or later security updates are missing.
4. Run a local exploit targeting the Microsoft Enhanced Cryptographic Provider elevation-of-privilege flaw.
5. Obtain elevated privileges or access to a higher-integrity security context.
6. Use the elevated access to dump credentials, modify security settings, install persistence, access restricted data, or move laterally.

How to detect it

Because this is a local privilege escalation vulnerability, there may be no network-facing exploit signature and no single reliable log entry proving exploitation. Focus detection on post-exploitation behavior on Windows systems that were unpatched after June 2021. Review endpoint detection telemetry, Sysmon, Windows Security logs, PowerShell logs, process creation logs, service-control activity, local user and group changes, credential access alerts, and antivirus or EDR detections around the time of suspicious low-privileged execution. Look for unusual processes launched from user-writable directories, unexpected privilege transitions, new services or scheduled tasks, LSASS access attempts, creation of new local administrator accounts, changes to security tooling, and anomalous use of built-in administrative utilities. Correlate these events with patch posture: exploitation is most plausible where the host was affected and missing the relevant Microsoft security update at the time of activity.

• Windows Security Event ID 4688
• Windows Security Event ID 4672
• Windows Security Event ID 4720
• Windows Security Event ID 4732
• Windows Security Event ID 4697
• Windows Security Event ID 7045
• Microsoft-Windows-PowerShell/Operational Event ID 4104
• Sysmon Event ID 1
• Sysmon Event ID 7
• Sysmon Event ID 10
• Sysmon Event ID 11
• C:\Windows\System32\rsaenh.dll
• C:\Windows\SysWOW64\rsaenh.dll
• C:\Users\Public\
• C:\Windows\Temp\
• C:\ProgramData\

What your security team should do

• Treat unpatched affected Windows systems as priority remediation targets because the vulnerability is in the CISA Known Exploited Vulnerabilities catalog and has documented in-the-wild exploitation.
• Patch or retire all affected Windows versions, giving highest priority to internet-facing servers, shared workstations, administrator workstations, domain infrastructure, jump hosts, and systems used by privileged users.
• Hunt for signs of post-compromise privilege escalation on systems that remained unpatched after June 2021, especially where initial-access alerts, malware detections, or unusual local process activity were observed.
• Enforce least privilege by removing unnecessary local administrator rights and limiting which users can log on interactively to servers.
• Enable or tune endpoint detection for suspicious child processes, token manipulation, credential dumping, creation of new local administrators, service installation, and execution from temporary or user-writable directories.
• Use application control, attack surface reduction rules, and tamper protection to reduce the ability of low-privileged attackers to execute local exploit tooling.
• For systems that cannot be patched immediately, isolate them, increase logging, restrict access paths, and document a time-bound exception with compensating controls.