CVE-2021-33739

What it actually does

CVE-2021-33739 is a local elevation-of-privilege vulnerability in the Microsoft Desktop Window Manager (DWM) Core Library. An attacker who can execute code on an affected Windows system can abuse the flaw to elevate from a low-privileged context to high-integrity privileges, potentially SYSTEM-level control. Successful exploitation can allow the attacker to bypass normal Windows privilege boundaries, execute arbitrary code with elevated rights, modify protected files or registry settings, disable security tooling, dump credentials, and establish persistence. The CVSS vector is local, low-complexity, no user interaction, and no privileges required, making it valuable as a post-compromise escalation primitive.

Why it matters to the business

This vulnerability turns an initial foothold on a Windows workstation or server into full local control, increasing the likelihood of credential theft, lateral movement, security-tool tampering, and broader domain compromise. Because it is listed in CISA KEV and has active in-the-wild exploitation, organizations should treat remaining unpatched Windows 10 and Windows Server 2004/20H2 systems as high-priority risk even though the bug is local-only. CISA required remediation for federal agencies by 2021-11-17, and systems still missing the June 2021 or later cumulative updates represent long-standing exposure.

How an attack unfolds

An attacker first needs a way to run code on an affected Windows host, such as malware delivered by phishing, a malicious document, a browser exploit, abuse of remote access, or execution through another compromised application. Once local code execution is achieved, the attacker launches exploit code targeting the DWM Core Library vulnerability. The exploit manipulates vulnerable DWM behavior to cross the local privilege boundary and spawn or inject code into a higher-privileged context. With elevated privileges, the attacker can create administrator accounts, disable endpoint protections, access credential material, install persistence mechanisms, and use the host as a staging point for lateral movement. In real intrusions, this class of vulnerability is commonly chained after initial access vulnerabilities to convert limited user execution into full host compromise.

How to fix it

Apply the Microsoft June 2021 security updates or any later cumulative update for all affected Windows versions. For Windows 10 version 1909, deploy KB5003635 or a later cumulative update. For Windows 10 versions 2004, 20H2, and 21H1, and Windows Server versions 2004 and 20H2, deploy KB5003637 or a later cumulative update. Systems running unsupported Windows releases should be upgraded to a supported version and fully patched. If immediate patching is not possible, reduce exposure by limiting interactive logon rights, restricting execution of untrusted binaries, enforcing application control, preventing users from running with local administrator rights, hardening endpoint detection controls, and prioritizing monitoring for suspicious privilege escalation and post-exploitation behavior. Mitigations do not replace the security update because the vulnerability is local and may be triggered by any code that already executes on the host.

How to confirm the fix worked

Confirm remediation by verifying that affected systems have the June 2021 cumulative update or a later cumulative update installed. Check Windows build numbers and installed hotfixes using tools such as Windows Update, enterprise patch management, PowerShell Get-HotFix, Windows Update for Business reporting, Microsoft Defender Vulnerability Management, or configuration management inventory. Expected patched baselines include Windows 10 1909 build 18363.1621 or later, and Windows 10/Windows Server 2004, 20H2, and Windows 10 21H1 builds 19041.1052, 19042.1052, or 19043.1052 or later, respectively. Validate that no affected Windows 10 1909, 2004, 20H2, 21H1, Windows Server 2004, or Windows Server 20H2 assets remain without a superseding cumulative update. Where available, run authenticated vulnerability scans to confirm the CVE is no longer reported.

Typical attack path

1. Gain initial code execution on an affected Windows 10 or Windows Server system through phishing, malware, exploitation of another vulnerability, or abuse of remote access.
2. Run local exploit code that targets the Microsoft DWM Core Library elevation-of-privilege flaw.
3. Trigger the vulnerable DWM behavior to escape the original low-privileged execution context.
4. Obtain elevated execution, commonly high-integrity or SYSTEM-level privileges.
5. Use elevated access to disable defenses, dump credentials, modify protected system settings, or install persistence.
6. Move laterally or perform follow-on objectives using the compromised host and harvested credentials.

How to detect it

There are no reliable universal file, network, or registry indicators that uniquely identify exploitation of this vulnerability. Detection should focus on behavioral evidence of local privilege escalation and follow-on activity. Review endpoint telemetry, EDR events, Windows Security logs, Sysmon logs, application crash logs, and Windows Error Reporting around suspicious user-level process activity followed by elevated or SYSTEM-level execution. Look for unexpected high-integrity process creation, processes spawning command shells or scripting engines shortly after user-launched applications, creation of new local administrators, abnormal service or scheduled task creation, tampering with endpoint security services, LSASS access, credential dumping tools, and unusual DWM-related crashes or faults. Useful Windows events include Security 4688 for process creation, 4672 for special privileges assigned, 4624 logon type changes, 4720/4728/4732 for user or group changes, 4697 for service installation, 7045 in the System log for new services, 4698 for scheduled task creation, and Sysmon Event ID 1, 7, 10, 11, and 13 for process, module, process access, file, and registry activity. Because exploitation is local, network logs usually show only surrounding intrusion activity rather than the exploit itself; correlate suspected exploitation with initial access, malware staging, and lateral movement events.

What your security team should do

• Prioritize patch verification immediately for all affected Windows 10 and Windows Server systems because the vulnerability is in CISA KEV and has active exploitation history.
• Identify any remaining Windows 10 1909, 2004, 20H2, 21H1, Windows Server 2004, and Windows Server 20H2 assets and ensure they have the June 2021 cumulative update or later installed.
• Treat unpatched endpoints as potentially exposed to post-compromise privilege escalation and increase monitoring until patched.
• Hunt for signs of local privilege escalation followed by credential theft, security-tool tampering, new administrator creation, suspicious services, scheduled tasks, or unusual child processes launched with elevated privileges.
• Restrict local administrator rights and enforce application control to reduce the chance that an initial foothold can execute exploit tooling.
• Correlate detections for initial access malware with sudden high-privilege activity on the same host, because this vulnerability is most useful after an attacker already has local code execution.
• For unsupported Windows versions, accelerate migration or isolation because patch coverage and security telemetry may be incomplete.