CVE-2021-33771

What it actually does

CVE-2021-33771 is a local Windows Kernel elevation-of-privilege vulnerability caused by memory corruption in kernel-mode code. An attacker who already has the ability to execute code with low privileges on an affected Windows host can exploit the flaw to gain elevated privileges, potentially up to NT AUTHORITY\SYSTEM. Successful exploitation can allow the attacker to bypass normal user privilege boundaries, access protected files and processes, disable security controls, tamper with system configuration, and execute arbitrary code in a highly privileged context. The vulnerability affects multiple Windows client and server versions, including Windows 8.1, Windows RT 8.1, Windows 10 releases, Windows Server 2008, 2012, 2016, 2019, 2004, and 20H2.

Why it matters to the business

This vulnerability is most dangerous after an attacker has already gained an initial foothold, because it can turn limited access into full control of a Windows workstation or server. In business terms, it can enable faster lateral movement, credential theft, security tool tampering, persistence, data access, and disruption of critical systems. It is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation due date of 2021-11-17 and has documented in-the-wild exploitation, so unpatched systems should be treated as high-priority exposure even though exploitation requires local access. The broad impact across Windows desktop and server versions increases operational risk in legacy or inconsistently patched fleets.

How an attack unfolds

An attacker typically begins by obtaining local code execution on an affected Windows system through phishing, malware execution, stolen credentials, remote service compromise, or another vulnerability. Once running as a standard or otherwise low-privileged user, the attacker deploys or executes a privilege-escalation exploit targeting the Windows Kernel memory corruption flaw. The exploit manipulates vulnerable kernel behavior to corrupt memory in a way that changes security context or permits execution of attacker-controlled code with kernel-level privileges. If successful, the attacker obtains SYSTEM-level capabilities, then commonly uses that access to dump credentials, disable endpoint defenses, install persistence mechanisms, modify system settings, access sensitive data, or move laterally to other systems. Because this vulnerability is known to have been exploited in the wild and is included in the KEV catalog, defenders should assume public or private exploit implementations may be available to capable attackers.

How to fix it

Apply the Microsoft security updates that address CVE-2021-33771 for all affected Windows versions. Because no fixed build numbers were provided in the input, use the applicable July 2021 or later cumulative/security updates from Microsoft for each Windows release and verify that systems are on supported servicing branches. Prioritize internet-facing servers, remote-access infrastructure, domain-joined workstations used by administrators, servers holding sensitive data, and systems where untrusted users can execute code. If immediate patching is not possible, reduce risk by restricting local logon rights, removing unnecessary users from local administrator groups, enforcing application control, enabling endpoint detection and response, blocking untrusted executable/script execution, hardening credential storage, and isolating high-risk legacy Windows hosts. Mitigations reduce exploitability and blast radius but should not be considered substitutes for applying the vendor security update.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows endpoint has installed the relevant Microsoft security update or a later cumulative update that supersedes it. Use centralized patch management, vulnerability scanners, Microsoft Update compliance reports, or PowerShell inventory to confirm OS build, servicing state, and installed hotfixes across affected Windows client and server versions. Where possible, run authenticated vulnerability scans that specifically check for CVE-2021-33771 exposure rather than relying only on banner or unauthenticated checks. Validate that unsupported Windows versions have been upgraded, isolated, or otherwise removed from production exposure. Also confirm that endpoint controls remain active after patching and that local privilege boundaries are enforced for non-administrative users.

Typical attack path

1. Gain an initial foothold on an affected Windows host using phishing, malware, stolen credentials, exposed services, or another vulnerability.
2. Execute code locally as a low-privileged user or service account.
3. Run a local exploit for the Windows Kernel memory corruption vulnerability.
4. Abuse the kernel flaw to elevate privileges to a high-integrity administrator or NT AUTHORITY\SYSTEM context.
5. Use elevated privileges to disable security tooling, dump credentials, access protected resources, or establish persistence.
6. Use harvested credentials or elevated access to move laterally, escalate domain impact, or stage additional payloads.

How to detect it

Detecting exploitation of this vulnerability directly is difficult because local kernel privilege-escalation exploits may not produce unique Windows event log entries. Focus on evidence of suspicious privilege transitions and post-exploitation behavior on systems that were unpatched at the time of activity. Review endpoint detection telemetry, Sysmon, Windows Security logs, PowerShell logs, service control manager logs, driver load events, crash dumps, and antivirus/EDR alerts. Look for low-privileged user processes spawning SYSTEM-level shells or tools, unexpected creation of services or scheduled tasks, suspicious unsigned or newly dropped kernel drivers, abnormal child processes from user-writable paths, lsass.exe access attempts, credential dumping behavior, tampering with Defender or other endpoint agents, and unexpected local administrator group changes. Correlate activity against patch status: hosts missing the July 2021 or later relevant Windows cumulative/security update during suspicious activity warrant deeper forensic review. Because this CVE is KEV-listed and exploited in the wild, any suspicious local privilege escalation followed by credential access, defense evasion, or lateral movement on affected Windows versions should be investigated as potentially related even if the exploit artifact is no longer present.

• NT AUTHORITY\SYSTEM
• C:\Windows\System32\cmd.exe
• C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
• C:\Windows\System32\sc.exe create
• C:\Windows\System32\schtasks.exe /create
• wevtutil cl
• vssadmin delete shadows
• bcdedit /set {default} safeboot minimal
• reg add HKLM\SOFTWARE\Microsoft\Windows Defender
• Set-MpPreference -DisableRealtimeMonitoring $true
• Event ID 7045
• Event ID 4697
• Event ID 4672
• Event ID 4688
• Event ID 1102
• Event ID 7036
• Event ID 6
• lsass.exe
• procdump.exe -ma lsass.exe
• rundll32.exe comsvcs.dll, MiniDump

What your security team should do

• Treat this as a high-priority patching item because it is in CISA KEV, has active in-the-wild exploitation, and enables full local system compromise after initial access.
• Inventory all affected Windows client and server versions, including legacy Windows Server 2008/2012 and older Windows 10 releases, and verify installation of the applicable Microsoft security update or later cumulative update.
• Prioritize remediation on systems used by administrators, systems with many interactive users, servers with sensitive data, and hosts where malware execution would have high business impact.
• Hunt for signs of post-exploitation activity such as unexpected SYSTEM-level processes, new services, credential dumping tools, endpoint security tampering, suspicious driver loads, and unusual privilege escalation events.
• Reduce attack surface by enforcing least privilege, removing unnecessary local administrator rights, enabling application control, and blocking execution from user-writable directories.
• For systems that cannot be patched, isolate them from untrusted users and networks, increase monitoring, restrict interactive logon, and plan accelerated replacement or upgrade.
• Review incidents or malware detections on unpatched systems since July 2021 for possible privilege escalation and follow-on compromise.