CVE-2021-34527

What it actually does

This vulnerability, commonly known as PrintNightmare, affects the Windows Print Spooler service when it performs privileged printer driver/file operations incorrectly. An attacker with low-privileged access can abuse printer driver installation or Point and Print behavior over RPC/SMB or locally to cause spoolsv.exe to copy and load attacker-controlled code with NT AUTHORITY\SYSTEM privileges. Successful exploitation results in full local system compromise and can be especially severe on domain controllers or broadly reachable Windows servers because the Print Spooler often runs with high privilege and is exposed over the network.

Why it matters to the business

Compromise can give an attacker complete control of affected Windows systems, enabling data theft, account creation, lateral movement, domain compromise, and ransomware deployment. This issue is in CISA KEV, has been exploited in the wild, has very high EPSS likelihood, and is associated with ransomware activity, so unpatched or misconfigured systems should be treated as high-priority exposure even though the vulnerability is older. Systems that run Print Spooler unnecessarily, especially domain controllers and servers, create disproportionate operational risk because compromise can spread beyond a single endpoint.

How an attack unfolds

An attacker first obtains a low-privileged account or foothold on a Windows network and identifies systems where the Print Spooler service is running and reachable. The attacker connects to the spooler RPC interface, commonly over SMB/named pipe access to the spooler service, and abuses printer driver installation functionality such as AddPrinterDriverEx/RpcAddPrinterDriverEx or insecure Point and Print policy behavior. The attacker provides a malicious driver package or DLL path, often staged on a network share, causing the Print Spooler service to copy the file into a spool driver directory and load it. Because spoolsv.exe runs as SYSTEM, the payload executes with full local privileges. From there, the attacker may dump credentials, disable security tools, create privileged accounts, move laterally to other hosts, target domain controllers, and deploy ransomware or other post-exploitation tooling.

How to fix it

Apply the Microsoft security updates released July 6/7, 2021 or any later cumulative Windows update that includes the Print Spooler fixes. Patching alone should be paired with configuration validation: ensure HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint\NoWarningNoElevationOnInstall is set to 0 or not defined, and HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint\UpdatePromptSettings is set to 0 or not defined. Disable the Print Spooler service on systems that do not require printing, especially domain controllers, servers, and internet-adjacent systems. Where printing is required, restrict inbound SMB/RPC access to approved print servers, restrict printer driver installation to administrators, and apply Microsoft KB5005010 guidance for limiting new printer driver installation. Review Group Policy for Point and Print restrictions and remove configurations that suppress elevation prompts or allow non-admin driver installation. If using the supplied package-tracking metadata for MISP/GIT content, ensure it is updated to commit 78edbbca64a1edc4390560cc106d0d418064355d where applicable, but Windows host patching and Print Spooler hardening are the primary remediation for this vulnerability.

How to confirm the fix worked

Confirm each Windows system has July 2021 or later cumulative security updates installed for its supported OS version. Validate that the Spooler service is disabled where not operationally required using service inventory or commands such as Get-Service Spooler/sc query spooler. Confirm Point and Print registry values are absent or set to 0, not 1. Review Group Policy to ensure non-administrators cannot install printer drivers without elevation and that new printer driver installation is restricted. Test network exposure by verifying that only authorized print servers can reach spooler-related SMB/RPC services on Windows hosts. On systems that must run Print Spooler, validate that printer driver directories contain only expected, signed, trusted drivers and that no recent unexpected DLLs were written under spool driver paths.

Typical attack path

1. Obtain low-privileged Windows credentials or an initial foothold inside the network.
2. Scan for Windows hosts with the Print Spooler service running and reachable over SMB/RPC.
3. Check whether Point and Print settings or missing July 2021-or-later updates allow unsafe driver installation behavior.
4. Stage a malicious printer driver DLL or payload on a reachable local or network path.
5. Invoke printer driver installation APIs such as AddPrinterDriverEx/RpcAddPrinterDriverEx against the target spooler service.
6. Cause spoolsv.exe to copy/load the attacker-controlled DLL from the spool driver directory.
7. Execute code as NT AUTHORITY\SYSTEM on the target host.
8. Use SYSTEM-level access for credential theft, persistence, lateral movement, domain escalation, or ransomware deployment.

How to detect it

Investigate Windows PrintService logs, Security logs, Sysmon/EDR telemetry, SMB file share access logs, and endpoint file-system artifacts. Key log sources include Microsoft-Windows-PrintService/Admin and Operational logs for printer driver installation or load failures; Windows Security events for logon, privilege use, process creation, service creation, and SMB share access; Sysmon events for process creation, image load, network connections, registry changes, and file creation; and EDR telemetry for spoolsv.exe behavior. Look for unexpected printer driver installations, especially drivers loaded from UNC paths or written shortly before suspicious process execution. Review spoolsv.exe for abnormal child processes such as cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, wscript.exe, cscript.exe, mshta.exe, certutil.exe, or ransomware tooling. Search spool driver directories for recently created, unsigned, or non-Microsoft DLLs. Investigate network connections to spooler named pipes and unexpected inbound SMB/RPC connections to non-print servers. Because this vulnerability has been used in ransomware campaigns, also hunt for rapid privilege escalation followed by credential dumping, security tool tampering, mass file encryption, new local/domain admin accounts, scheduled tasks, or remote service creation after suspicious Print Spooler activity.

• \\pipe\\spoolss
• RpcAddPrinterDriverEx
• AddPrinterDriverEx
• spoolsv.exe
• C:\\Windows\\System32\\spool\\drivers\\x64\\3\\
• C:\\Windows\\System32\\spool\\drivers\\x64\\3\\old\\
• C:\\Windows\\System32\\spool\\drivers\\W32X86\\3\\
• C:\\Windows\\System32\\spool\\drivers\\color\\
• HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\\PointAndPrint
• NoWarningNoElevationOnInstall
• UpdatePromptSettings
• Microsoft-Windows-PrintService/Operational
• Microsoft-Windows-PrintService/Admin
• Printer driver
• was added or updated
• The print spooler failed to load a plug-in module
• spoolsv.exe cmd.exe
• spoolsv.exe powershell.exe
• spoolsv.exe rundll32.exe
• spoolsv.exe regsvr32.exe
• spoolsv.exe mshta.exe
• spoolsv.exe certutil.exe

What your security team should do

• Immediately prioritize remediation for domain controllers, servers, privileged administration workstations, and any host where Print Spooler is reachable from broad network segments.
• Disable Print Spooler everywhere it is not required; this is the strongest mitigation for non-printing systems.
• Patch all supported Windows systems with July 2021-or-later cumulative security updates and verify installation rather than relying only on vulnerability scanner results.
• Audit and enforce Point and Print registry/GPO settings so NoWarningNoElevationOnInstall and UpdatePromptSettings are set to 0 or not defined.
• Restrict SMB/RPC access to print services using host firewalls, network segmentation, and allowlists for approved print servers.
• Hunt historically for spoolsv.exe spawning shells, loading unusual DLLs, writing to spool driver directories, or communicating outbound to suspicious destinations.
• Treat confirmed exploitation as full SYSTEM compromise: collect forensic evidence, rotate exposed credentials, check for lateral movement, and investigate ransomware staging or deployment.
• Create SIEM detections for suspicious printer driver installation events, spool driver directory writes, and child processes launched by spoolsv.exe.