CVE-2021-36955

What it actually does

CVE-2021-36955 is a local elevation-of-privilege vulnerability in the Windows Common Log File System (CLFS) kernel driver. An attacker who already has low-privileged code execution on an affected Windows system can exploit the flaw to gain elevated privileges, typically SYSTEM-level execution. Because CLFS is a kernel-mode Windows component present across many desktop and server versions, successful exploitation can give the attacker broad control over the host, including the ability to disable security tooling, access protected data, install persistence, and move laterally using harvested credentials.

Why it matters to the business

This vulnerability turns an initial foothold, such as a phished user session, malware infection, or exploited low-privilege service account, into full control of a Windows endpoint or server. It is listed in CISA KEV, has been actively exploited in the wild, and is associated with ransomware use, making remediation urgent even though exploitation requires local access first. Unpatched systems may enable ransomware operators or intruders to bypass least-privilege controls, compromise sensitive systems, disrupt operations, and increase recovery costs after an incident.

How an attack unfolds

An attacker first obtains local code execution on an affected Windows system through a separate vector such as phishing, malicious document execution, exposed remote access, credential theft, or exploitation of an application vulnerability. From that low-privileged context, the attacker runs exploit code targeting the Windows CLFS driver. The exploit abuses improper handling in the kernel driver to elevate privileges from a standard user context to a highly privileged context such as NT AUTHORITY\SYSTEM. Once elevated, the attacker can dump credentials, tamper with endpoint defenses, install services or scheduled tasks for persistence, access files normally restricted to administrators, and use the host as a staging point for lateral movement or ransomware deployment.

How to fix it

Apply the Microsoft security updates that address CVE-2021-36955 for all affected Windows desktop and server versions, including Windows 7, Windows 8.1, Windows RT 8.1, Windows 10 releases, Windows Server 2008, 2012, 2016, 2019, 2022, and Windows Server SAC releases listed as affected. Because this vulnerability is in CISA KEV and associated with ransomware campaigns, prioritize internet-facing systems, remote access servers, domain controllers, virtualization hosts, file servers, backup infrastructure, and user endpoints commonly used for email and web browsing. Where immediate patching is not possible, reduce risk by limiting local logon rights, removing unnecessary administrator privileges, enforcing application control, enabling tamper protection for endpoint security tools, monitoring for suspicious privilege escalation behavior, and isolating high-risk unpatched systems until updates can be applied. There is no reliable configuration-only mitigation that should be treated as equivalent to installing the vendor patch.

How to confirm the fix worked

Confirm that affected Windows systems have installed the Microsoft cumulative update or security-only update released for this vulnerability for their operating system version. Validate through centralized patch management, endpoint management inventory, vulnerability scanning, or local checks using Windows Update history, installed hotfix inventory, or build/revision levels. Confirm coverage across both workstations and servers, including legacy systems that may require Extended Security Updates. After patching, reboot systems where required and rescan to verify the vulnerability is no longer reported. For exposure validation, identify Windows assets running affected versions and compare installed cumulative update levels against Microsoft’s security update guidance for the September 2021 release cycle and later superseding updates.

Typical attack path

1. Gain initial access to a Windows workstation or server through phishing, stolen credentials, malware, exposed remote access, or another vulnerability.
2. Execute code as a low-privileged local user on an affected Windows version.
3. Run a local privilege escalation exploit targeting the Windows Common Log File System driver.
4. Obtain elevated privileges, commonly SYSTEM-level execution.
5. Disable or tamper with security controls, collect credentials, and establish persistence.
6. Move laterally to additional systems or deploy payloads such as ransomware.

How to detect it

Investigate whether low-privileged users on affected Windows systems recently achieved SYSTEM or administrator-level execution without an expected administrative workflow. Useful log sources include Windows Security logs, Sysmon or EDR process telemetry, service control manager events, scheduled task logs, PowerShell logs, Windows Defender or other endpoint protection logs, and vulnerability or patch-management timelines. Look for exploit execution from user-writable directories such as Downloads, Temp, AppData, or public folders followed closely by new SYSTEM processes, command shells, credential access tools, security tool tampering, or lateral movement. Review Windows Security Event ID 4688 for suspicious process creation, Event ID 4672 for special privileges assigned to new logons, Event ID 7045 in the System log for new service installation, scheduled task events 106/140/141, PowerShell Event IDs 4103/4104, and endpoint alerts for kernel exploit, privilege escalation, or CLFS-related activity. Because public reporting does not provide a single universal file hash, command line, or network indicator for this vulnerability, behavior-based detection is more reliable than static IOC matching. Correlate exploitation windows with missing September 2021 or later Windows security updates and any follow-on activity such as LSASS access, SAM/SYSTEM hive reads, ransomware staging, backup deletion, or mass file modification.

• Windows Security Event ID 4688
• Windows Security Event ID 4672
• System Event ID 7045
• Microsoft-Windows-TaskScheduler/Operational Event ID 106
• Microsoft-Windows-TaskScheduler/Operational Event ID 140
• Microsoft-Windows-TaskScheduler/Operational Event ID 141
• Microsoft-Windows-PowerShell/Operational Event ID 4103
• Microsoft-Windows-PowerShell/Operational Event ID 4104
• NT AUTHORITY\SYSTEM
• C:\Windows\System32\drivers\clfs.sys
• \AppData\Local\Temp\
• \Windows\Temp\
• \Users\Public\
• vssadmin.exe delete shadows
• wmic.exe shadowcopy delete
• bcdedit.exe /set {default} recoveryenabled No
• bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
• reg save HKLM\SAM
• reg save HKLM\SYSTEM
• procdump.exe -ma lsass.exe
• rundll32.exe comsvcs.dll, MiniDump

What your security team should do

• Treat this as high priority because it is in CISA KEV, has active exploitation, and is associated with ransomware activity.
• Patch all affected Windows systems with the applicable Microsoft security update or a later superseding cumulative update, prioritizing servers, privileged-access workstations, remote access infrastructure, and high-value endpoints.
• Hunt for signs of local privilege escalation followed by SYSTEM-level process creation, credential dumping, endpoint security tampering, new service creation, or suspicious scheduled tasks.
• Review recent alerts involving low-privileged users spawning elevated shells, administrative tooling, or security-control changes on Windows hosts.
• Ensure endpoint detection and response tooling is active, tamper-protected, and collecting process, service, driver, PowerShell, and Windows security events.
• Restrict local administrator rights, enforce least privilege, and use application control to limit execution of untrusted binaries from user-writable directories.
• Audit unpatched legacy Windows systems and isolate, upgrade, or decommission systems that cannot receive security updates.
• Because the CISA KEV due date was 2021-11-17, treat any remaining unpatched instance as an overdue remediation exception requiring risk acceptance or immediate compensating controls.