CVE-2021-40450

What it actually does

CVE-2021-40450 is a local elevation-of-privilege vulnerability in the Windows Win32k kernel-mode graphics/windowing subsystem. An attacker who can already execute code as a low-privileged local user can trigger the flaw to obtain elevated privileges, typically up to NT AUTHORITY\SYSTEM. Successful exploitation can give the attacker full control over the affected Windows host, including access to protected files, credentials, security tooling, and administrative functions.

Why it matters to the business

This vulnerability can turn an initial foothold, such as a phished user session, malicious document execution, compromised account, or exposed remote access session, into full host compromise. Because it affects common Windows desktop and server versions and is listed in CISA KEV with known exploitation in the wild, unpatched systems should be treated as high-priority remediation targets even though exploitation requires prior local code execution. Operational consequences include workstation or server takeover, credential theft, lateral movement, persistence, data access, and potential disruption of business services.

How an attack unfolds

An attacker first gains the ability to run code on an affected Windows system with low privileges, often through phishing, malware delivery, exploitation of another vulnerability, or misuse of valid credentials. The attacker then runs a local exploit that interacts with the Win32k subsystem through crafted user-mode calls, abusing the kernel vulnerability to corrupt or manipulate privileged kernel state. If successful, the exploit causes the attacker-controlled process or a spawned payload to run with elevated privileges, commonly SYSTEM. From there, the attacker can disable security controls, dump credentials, install persistence, access sensitive data, and move laterally to other systems. This vulnerability has been observed as actively exploited, so evidence of pre-patch compromise should be investigated rather than assuming patching alone removes attacker access.

How to fix it

Apply the Microsoft security update that addresses CVE-2021-40450 for all affected Windows versions, including Windows 10 1809, 1909, 2004, 20H2, 21H1; Windows 11 21H2; Windows Server 2004, 20H2, 2019, and 2022. In practice, systems should be brought to a supported build level and patched with the October 2021 cumulative update or any later cumulative update that supersedes it. Prioritize internet-facing servers, jump hosts, remote access systems, administrator workstations, domain administration endpoints, and systems used by high-risk users. Where immediate patching is not possible, reduce risk by removing local administrative rights, restricting interactive logon, enforcing application control, blocking execution from user-writable directories, enabling endpoint protection/EDR, and isolating systems until patched. Because the issue is in the OS kernel attack surface, configuration-only mitigations should be treated as temporary risk reduction rather than a substitute for patching.

How to confirm the fix worked

Confirm each affected Windows system has installed the relevant Microsoft cumulative security update from October 2021 or later. Use enterprise patch management, vulnerability scanners, Windows Update compliance reporting, or host commands such as Get-HotFix, DISM, or Windows Update history to verify patch status and OS build level. Validate that unsupported or end-of-servicing Windows builds have been upgraded to supported releases, because unsupported systems may not receive the required security fixes. After patching, rescan with authenticated vulnerability checks and confirm the vulnerability is no longer reported. For high-risk systems, also confirm there are no suspicious privileged processes, unauthorized services, persistence mechanisms, or signs of post-exploitation activity that predate remediation.

Typical attack path

1. Gain initial low-privileged code execution on a vulnerable Windows workstation or server.
2. Confirm the operating system build is affected and suitable for the exploit.
3. Run a local Win32k privilege-escalation exploit from the compromised user context.
4. Obtain elevated privileges, typically SYSTEM or an administrator-equivalent token.
5. Execute follow-on actions such as credential dumping, defense evasion, persistence creation, data discovery, or lateral movement.
6. Use the elevated host access to expand compromise across the environment or support broader intrusion objectives.

How to detect it

There is no single reliable file, process name, or network indicator that uniquely identifies exploitation of this Win32k local privilege-escalation vulnerability. Detection should focus on behavior before and after elevation. Review EDR, Sysmon, Windows Security, PowerShell, service control, scheduled task, and application control logs for low-privileged user processes that suddenly create SYSTEM-level child processes, install services, create scheduled tasks, modify security tooling, access LSASS, or run administrative utilities from user-writable paths. Useful log sources include Windows Security events for process creation if enabled, privilege assignment and sensitive privilege use, service installation, scheduled task creation, account changes, and logon session changes; Sysmon process creation, image load, driver load, file creation, and registry modification events; EDR kernel exploit or suspicious token manipulation alerts; and vulnerability management records showing systems were exposed before patching. Pay special attention to activity on systems that remained unpatched after publication or after the KEV due date. Investigate sequences where an initial user-context process is followed shortly by SYSTEM shells, credential dumping, disabling security products, creation of persistence, or lateral movement tooling. Since exploitation is local, network logs are more useful for identifying the initial access vector and post-compromise lateral movement than for detecting the kernel exploit itself.

What your security team should do

• Treat this as a priority remediation item because it is in CISA KEV and has active in-the-wild exploitation history; the CISA remediation deadline was 2022-05-16.
• Patch or retire all affected Windows desktop and server builds, prioritizing systems that process untrusted content, provide remote access, or are used for administration.
• Run authenticated vulnerability scans and patch compliance checks to identify any remaining Windows systems missing the October 2021 or later cumulative update.
• Hunt for signs of local privilege escalation followed by SYSTEM-level activity, especially where low-privileged user processes spawned administrative tools, services, scheduled tasks, credential dumping tools, or security-control changes.
• Review EDR telemetry for suspicious execution from user-writable paths such as user profile temp directories, downloads folders, archive extraction paths, and shared folders.
• Investigate any pre-patch detections as potential host compromise; patching prevents re-exploitation but does not remove persistence or stolen credentials.
• Limit local administrative rights and enforce least privilege to reduce the impact of successful endpoint exploitation.
• Strengthen application control and attack surface reduction rules to prevent untrusted binaries and scripts from executing in user contexts.
• Reset credentials and review lateral movement paths if exploitation is suspected on systems used by privileged users.
• Ensure legacy Windows versions are upgraded to supported releases so they continue receiving cumulative kernel security fixes.