CVE-2021-36948

What it actually does

CVE-2021-36948 is a local elevation-of-privilege vulnerability in the Windows Update Medic Service, a privileged Windows component responsible for repairing and maintaining Windows Update functionality. A user or process with low-privileged local access can abuse the flaw to execute actions with elevated privileges, typically SYSTEM-level privileges. Successful exploitation can allow full control of the affected Windows host, including reading protected data, modifying system files or security settings, installing persistence, and disrupting system availability.

Why it matters to the business

Because this vulnerability is listed in CISA KEV and has been observed exploited in the wild, unpatched Windows 10 and Windows Server systems represent a real operational risk rather than a theoretical one. An attacker who already has an initial foothold can use this flaw to take full control of a workstation or server, which may lead to credential theft, security tooling tampering, lateral movement, data exposure, and service disruption. The CISA remediation deadline of 2021-11-17 has long passed, so any remaining exposure should be treated as overdue remediation. The affected product set includes common enterprise Windows client and server versions, increasing the likelihood of broad exposure in older or poorly patched environments.

How an attack unfolds

Exploitation requires local access with low privileges, so attackers typically use this vulnerability after gaining an initial foothold through phishing, malware, stolen credentials, exposed remote access, or another vulnerability. Once code is running as a standard user, the attacker invokes or abuses vulnerable behavior in the Windows Update Medic Service to cause privileged service logic to perform attacker-controlled actions. If successful, the attacker obtains elevated execution, commonly as SYSTEM. From there, they can disable endpoint protections, create or modify administrator accounts, dump credentials, access sensitive files, install persistence mechanisms, and move laterally to other systems. Because the vulnerability is in a native Windows service, activity may blend into normal operating system behavior unless defenders monitor suspicious service interactions, unusual process ancestry, and privilege changes.

How to fix it

Apply the Microsoft security update that fixes CVE-2021-36948 for all affected Windows versions, including Windows 10 1809, 1909, 2004, 20H2, 21H1, Windows Server 2004, Windows Server 2019, and Windows Server 20H2. Because no exact fixed build list was provided, use the Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or another patch management platform to confirm the applicable cumulative update for each OS version. Prioritize internet-facing, remote-accessible, shared-user, VDI, administrator workstation, and server systems. Retire or isolate unsupported Windows versions that can no longer receive security updates. Do not rely on disabling the Windows Update Medic Service as a primary mitigation; it is a Windows servicing component and may be restored by the operating system. If immediate patching is not possible, reduce local logon rights, restrict remote interactive access, enforce least privilege, monitor for suspicious elevation behavior, and ensure EDR tamper protection is enabled.

How to confirm the fix worked

Confirm remediation by verifying that each affected host has installed the Microsoft cumulative security update released for CVE-2021-36948 or a later cumulative update. Use Windows Update history, enterprise patch tooling, or commands such as Get-HotFix, wmic qfe, systeminfo, or PowerShell-based inventory to compare OS build and installed KBs against the Microsoft Security Update Guide. Validate that Windows 10 and Windows Server builds are still supported and receiving cumulative updates. Where feasible, confirm the Windows Update Medic Service binary and related servicing components were updated by the relevant cumulative update. Exposure remains if a host is on an affected Windows version, has not received the appropriate cumulative update or later, or is running an unsupported OS release without extended security coverage.

Typical attack path

1. Gain initial access to a Windows 10 or Windows Server host using phishing, malware, stolen credentials, exposed remote access, or another vulnerability.
2. Execute code locally as a low-privileged user.
3. Check whether the host is an affected Windows version and whether relevant Microsoft security updates are missing.
4. Trigger the Windows Update Medic Service privilege escalation condition.
5. Obtain elevated execution, typically SYSTEM-level privileges.
6. Use elevated privileges to disable defenses, dump credentials, modify system settings, or establish persistence.
7. Use stolen credentials or administrative access to move laterally or expand control across the environment.

How to detect it

This is a local privilege escalation issue, so exploitation evidence is usually found on the compromised host rather than at the network perimeter. Review Windows Security logs, System logs, PowerShell logs, EDR telemetry, and Sysmon events for suspicious activity involving the Windows Update Medic Service. Useful sources include Security Event ID 4688 for process creation, 4672 for special privileges assigned to a new logon, 4624 for interactive or remote logons, 4697 for service installation, System Event ID 7045 for new service creation, 7036 for service state changes, and Sysmon Event IDs 1, 7, 10, 11, 12, 13, and 22 where available. Hunt for unusual child processes, command shells, script interpreters, or administrative tools launched near activity involving WaaSMedicSvc or WaaSMedicAgent.exe. Investigate low-privileged users that suddenly gain SYSTEM-level execution, create local administrator accounts, modify services, disable security tools, or access credential material. Also review EDR alerts for privilege escalation, LSASS access, service abuse, token manipulation, tamper protection changes, and anomalous Windows Update Medic Service behavior. There is no single public, reliable exploit artifact that proves exploitation across all environments, so detection should correlate vulnerable patch state, local service activity, process ancestry, privilege changes, and post-exploitation behavior.

• WaaSMedicSvc
• WaaSMedicAgent.exe
• C:\Windows\System32\WaaSMedicAgent.exe
• Windows Update Medic Service
• Service Control Manager
• Event ID 7045
• Event ID 7036
• Event ID 4688
• Event ID 4672
• NT AUTHORITY\SYSTEM
• cmd.exe
• powershell.exe
• pwsh.exe
• wscript.exe
• cscript.exe
• rundll32.exe
• regsvr32.exe
• schtasks.exe
• sc.exe

What your security team should do

• Treat remaining exposure as urgent because the vulnerability is in CISA KEV, has active exploitation history, and the federal remediation deadline has long passed.
• Inventory all affected Windows 10 and Windows Server versions and identify systems missing the relevant August 2021-or-later cumulative security update.
• Patch or upgrade exposed, high-value, shared-user, remote-accessible, and administrator workstation systems first.
• Remove, isolate, or apply compensating controls to unsupported Windows versions that cannot receive security updates.
• Hunt for suspicious local privilege escalation activity around the Windows Update Medic Service, especially unusual process creation, service manipulation, and sudden SYSTEM-level execution from non-administrative user context.
• Review hosts that recently showed endpoint protection tampering, new local administrators, credential dumping alerts, or abnormal lateral movement for possible post-exploitation activity.
• Enforce least privilege for local users and restrict interactive logon and remote access to reduce opportunities for local privilege escalation.
• Ensure EDR, Microsoft Defender, tamper protection, PowerShell logging, process creation logging, and service control logging are enabled on Windows endpoints and servers.