CVE-2021-34484

What it actually does

CVE-2021-34484 is a local elevation-of-privilege vulnerability in the Windows User Profile Service. A low-privileged attacker who can execute code on an affected Windows system can abuse improper handling of user profile-related operations to cause actions to occur with elevated privileges, potentially gaining NT AUTHORITY\SYSTEM-level control. Successful exploitation can provide full confidentiality, integrity, and availability impact on the local host.

Why it matters to the business

This vulnerability turns an initial low-privilege foothold into full host compromise, enabling attackers to disable security tooling, steal credentials, tamper with data, deploy persistence, and move laterally. It is listed in CISA’s Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-04-21 and has been observed exploited in the wild, so unpatched Windows endpoints and servers should be treated as high-priority exposure even though exploitation requires local access first.

How an attack unfolds

An attacker first obtains the ability to run code as a standard user on an affected Windows workstation or server, commonly through phishing, exposed remote access, malware execution, or abuse of a separate vulnerability. The attacker then triggers vulnerable Windows User Profile Service behavior related to profile handling and manipulates filesystem or profile-related objects so that the service performs privileged operations on attacker-influenced content. If successful, the attacker escalates from a normal user context to SYSTEM, after which they can create privileged accounts, install services, dump credentials, disable defenses, or use the host as a launch point for broader compromise. Because this flaw is a privilege-escalation issue, it is commonly chained after an initial access technique rather than used as the first step from the internet.

How to fix it

Apply the Microsoft security updates that address CVE-2021-34484 for all affected Windows client and server versions. In practice, systems should be updated to the August 2021 cumulative security update level or later, or to a currently supported cumulative update level for the relevant Windows release. Prioritize Windows 7, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2004, and Windows Server 20H2 systems that remain unpatched or out of support. Where immediate patching is not possible, reduce risk by removing local administrator rights, restricting interactive logon, enforcing application control, limiting remote access paths, monitoring privilege escalation behavior, and isolating high-risk systems until patched.

How to confirm the fix worked

Confirm that affected Windows hosts have installed the Microsoft cumulative update containing the August 2021 security fixes or any later cumulative update for their supported release. Validate through centralized patch management, Windows Update history, installed hotfix inventory, or OS build verification. Use vulnerability scanners authenticated to the host to confirm the CVE is no longer reported. For unsupported Windows versions, confirm the system has either received an applicable extended security update or has been upgraded, isolated, or decommissioned. Also verify that no untrusted standard-user account can reproduce local privilege escalation behavior in a controlled test environment.

Typical attack path

1. Gain low-privileged code execution on an affected Windows host.
2. Verify the host is running a vulnerable Windows build that lacks the relevant Microsoft security update.
3. Prepare attacker-controlled profile, directory, link, or file artifacts needed to influence User Profile Service behavior.
4. Trigger the vulnerable User Profile Service operation locally.
5. Obtain execution or file modification capability as SYSTEM or another elevated context.
6. Establish persistence, disable protections, access sensitive data, dump credentials, or move laterally.

How to detect it

Look for evidence of local privilege escalation following initial user-level execution. Useful sources include Windows Security logs, Sysmon, EDR process telemetry, Microsoft-Windows-User Profiles Service/Operational logs, service control manager logs, PowerShell logs, and file integrity monitoring. Investigate standard-user processes that shortly precede SYSTEM-level command shells, service creation, scheduled task creation, LSASS access, security tool tampering, or modifications to privileged Windows directories. Pay particular attention to profile creation, profile load/unload, unusual activity by the User Profile Service, unexpected filesystem junctions or symbolic links under user-writable paths, and rapid transitions from low-privilege execution to NT AUTHORITY\SYSTEM. Because exploitation may not leave a unique CVE-specific marker, detection should be behavior-based and correlated with patch state, suspicious local process ancestry, and post-exploitation actions.

• ServiceName=ProfSvc
• Microsoft-Windows-User Profiles Service/Operational
• User Profile Service
• NT AUTHORITY\SYSTEM
• Event ID 4688
• Event ID 4672
• Event ID 7045
• Event ID 4698
• schtasks.exe /create
• sc.exe create
• powershell.exe -ExecutionPolicy Bypass
• cmd.exe /c whoami /all
• whoami.exe /priv
• C:\Windows\System32\config\systemprofile\AppData\Local\Temp
• C:\Users\Public\
• C:\ProgramData\
• \AppData\Local\Temp\
• mklink /J
• mklink /D

What your security team should do

• Treat unpatched affected Windows systems as urgent because the vulnerability is in the CISA KEV catalog and has active in-the-wild exploitation history.
• Patch all affected Windows clients and servers to the August 2021 cumulative update level or later, prioritizing internet-adjacent, remote-access-enabled, shared, and high-value systems.
• Identify systems running end-of-life Windows versions and either upgrade, isolate, or decommission them if security updates cannot be applied.
• Review recent endpoint telemetry for low-privileged processes spawning SYSTEM shells, creating services, modifying privileged directories, or disabling security controls.
• Harden local privilege boundaries by removing unnecessary local administrator rights, enforcing least privilege, and applying application control such as Windows Defender Application Control or AppLocker where feasible.
• Correlate this vulnerability with initial-access alerts; local privilege escalation is often used after malware execution, phishing, exposed RDP/VPN access, or exploitation of another vulnerability.
• Ensure EDR rules alert on unusual User Profile Service interactions, suspicious symbolic link or junction activity, and privilege changes from standard user contexts to SYSTEM.