CVE-2021-41357

What it actually does

CVE-2021-41357 is a local elevation-of-privilege vulnerability in the Windows Win32k kernel-mode graphics/windowing subsystem. An attacker who already has code execution as a low-privileged local user can exploit the flaw to execute code with elevated privileges, typically SYSTEM or kernel-level effective control. The vulnerability has low attack complexity, requires no user interaction, and can result in full compromise of confidentiality, integrity, and availability on the affected Windows host.

Why it matters to the business

Successful exploitation can turn an initial limited foothold into full control of a Windows workstation or server. This enables attackers to disable security tools, steal credentials, access sensitive data, deploy persistence, move laterally, or support broader intrusion activity. Because this vulnerability is listed in CISA KEV and has been observed exploited in the wild, affected systems should be treated as high-priority remediation targets even though exploitation requires prior local access. Federal KEV remediation was due by 2022-05-16, so unpatched systems remain materially overdue.

How an attack unfolds

An attacker first obtains local code execution on an affected Windows system through phishing, stolen credentials, malware execution, exploitation of a separate remote vulnerability, or interactive access. From that low-privileged context, the attacker runs exploit code targeting the Win32k subsystem. If successful, the exploit manipulates the vulnerable kernel/user-mode interaction to elevate the attacker’s privileges. The attacker can then spawn a privileged shell or inject into a privileged process, install services or scheduled tasks, dump credentials, tamper with endpoint defenses, and use the compromised host as a platform for persistence and lateral movement. Public reporting indicates exploitation has occurred in the wild; the provided threat-actor label refers to active exploitation of the Microsoft Win32k privilege-escalation issue rather than a specific named group.

How to fix it

Apply the Microsoft security updates that address CVE-2021-41357 for all affected Windows versions, including Windows 10 2004, Windows 10 20H2, Windows 10 21H1, Windows 11 21H2, Windows Server 2004, Windows Server 20H2, and Windows Server 2022. Where exact fixed build numbers are not available in the supplied data, use Microsoft Security Update Guide and Windows Update/WSUS/Intune/SCCM compliance data to ensure the relevant October 2021 or later cumulative security updates are installed. Systems that cannot be patched should be isolated, restricted to trusted administrators, protected with application control, monitored aggressively, and retired or upgraded to supported Windows releases as soon as possible. Because this is a local privilege-escalation flaw, mitigation should also reduce initial access opportunities through least privilege, MFA for remote access, endpoint protection, attack surface reduction rules, and blocking execution from user-writable paths where feasible.

How to confirm the fix worked

Confirm that all affected Windows assets have installed the Microsoft cumulative security update that supersedes the October 2021 fix for CVE-2021-41357. Validate through centralized patch compliance tooling such as WSUS, Microsoft Configuration Manager, Intune, Defender Vulnerability Management, or equivalent asset-management platforms. On individual systems, verify installed updates with PowerShell commands such as Get-HotFix and compare OS build and patch level against Microsoft Security Update Guide guidance for the relevant Windows release. Confirm that unsupported or end-of-servicing Windows builds have been upgraded, isolated, or decommissioned. Exposure validation should include checking that endpoints are not merely reporting successful scan status but are actually on patched OS build levels after reboot.

Typical attack path

1. Gain initial local code execution on an affected Windows workstation or server using another technique such as phishing, malware, stolen credentials, or exploitation of a separate vulnerability.
2. Execute a local privilege-escalation exploit from the compromised low-privileged user context.
3. Abuse the Win32k vulnerability to obtain elevated privileges, commonly SYSTEM-level execution.
4. Start a privileged command shell, inject into a privileged process, or create a privileged service or scheduled task.
5. Disable or tamper with security controls and collect credentials or tokens from the host.
6. Establish persistence and use the elevated access for data access, lateral movement, or additional payload deployment.

How to detect it

There is no single reliable log entry that proves exploitation of this Win32k privilege-escalation vulnerability, so detection should focus on suspicious privilege transitions and post-exploitation behavior. Review Windows Security logs, Sysmon, EDR telemetry, PowerShell logs, service control manager logs, scheduled task logs, and endpoint protection events on systems that were unpatched. Look for low-privileged user processes spawning SYSTEM-level shells or administrative tools, unexpected token elevation, new services or scheduled tasks created shortly after suspicious user-level process execution, credential dumping activity, disabling of security tools, clearing of event logs, and lateral movement attempts. Useful Windows events include Security 4688 for process creation, 4672 for special privileges assigned, 4624 for logons, 7045 in the System log for service creation, 4697 for service installation, 4698 for scheduled task creation, 1102 for audit log clearing, and PowerShell 4103/4104 for suspicious script execution. In Sysmon, review Event ID 1 for process creation, 7 for unusual image loads, 10 for process access against credential-sensitive processes, 11 for suspicious file creation, and 13 for registry value changes. Prioritize hosts that were vulnerable, had interactive user activity, and subsequently showed SYSTEM-level execution from user-writable paths such as Downloads, Temp, AppData, or public directories.

What your security team should do

• Prioritize remediation on internet-facing servers, domain-joined workstations, administrator workstations, jump hosts, VDI images, and systems used by privileged users.
• Treat any unpatched affected system as overdue because the vulnerability is in CISA KEV, exploitation has been observed in the wild, and the KEV remediation deadline has passed.
• Use centralized patch management to deploy the applicable cumulative Windows security updates and verify reboot completion and final OS build level.
• Hunt for signs of post-exploitation behavior on systems that were exposed before patching, especially unexpected SYSTEM-level processes, new services, suspicious scheduled tasks, credential dumping, endpoint security tampering, and lateral movement.
• Restrict local administrator rights, enforce least privilege, and remove unnecessary interactive logon rights from servers.
• Enable or tune Windows process creation logging, PowerShell logging, Sysmon or equivalent EDR telemetry, and service/scheduled-task creation monitoring to improve detection of local privilege-escalation follow-on activity.
• Apply application control or attack surface reduction controls to limit execution from temporary directories, downloads folders, and other user-writable locations.
• Review EDR alerts and incident history around the original publication window and any later periods when vulnerable systems remained unpatched.