CVE-2021-41379

What it actually does

CVE-2021-41379 is a local Windows Installer privilege escalation vulnerability. A user who already has low-privileged code execution on an affected Windows host can abuse Windows Installer behavior to perform unauthorized privileged operations, most notably gaining elevated local privileges such as SYSTEM-level execution. The CVSS vector indicates local access is required, attack complexity is low, no user interaction is needed beyond the attacker’s existing local foothold, and the primary modeled impact is availability; in real-world abuse, the flaw is valuable because it can turn a limited compromise into full control of the endpoint or server.

Why it matters to the business

This vulnerability does not provide initial remote access by itself, but it materially increases the damage from phishing, credential theft, malware execution, exposed user accounts, or any other foothold on affected Windows systems. Once elevated, an attacker can disable security tools, tamper with logs, deploy ransomware, steal privileged credentials, move laterally, and take over business-critical servers. It is listed in CISA KEV, has active in-the-wild exploitation, and is associated with ransomware campaigns, so unpatched systems should be treated as high-priority remediation targets despite the moderate CVSS score. The CISA remediation deadline was 2022-03-17, meaning regulated and risk-managed environments should consider any remaining exposure significantly overdue.

How an attack unfolds

An attacker first obtains local code execution as a standard or otherwise limited Windows user, commonly through phishing, malware, stolen credentials, or exploitation of a separate vulnerability. They then run a public or custom exploit that abuses the vulnerable Windows Installer privilege-handling behavior. The exploit causes Windows Installer-related privileged operations to occur in a way the attacker can influence, allowing the attacker to execute commands or modify system state with elevated local privileges. After privilege escalation, the attacker typically creates or modifies privileged accounts, installs persistence, disables endpoint defenses, dumps credentials, stages tools, and may proceed to lateral movement or ransomware deployment. Because this vulnerability has been exploited in the wild and is known in ransomware tradecraft, detection should focus not only on patch state but also on signs that low-privileged processes invoked installer components and were quickly followed by SYSTEM-level shells, service creation, defense tampering, or ransomware staging.

How to fix it

Apply the Microsoft security updates that address CVE-2021-41379 for all affected Windows versions, including Windows 7/8.1/10/11 and Windows Server 2008/2012/2016/2019/2022 lines where still supported or covered by Extended Security Updates. Because no fixed build numbers were provided in the input, use the Microsoft Security Update Guide and the appropriate cumulative update history for each Windows release to verify the exact patch level. Prioritize internet-facing administrative systems, shared servers, domain-joined workstations, jump hosts, VDI images, and systems used by privileged administrators. Where immediate patching is not possible, reduce local logon rights, remove unnecessary local administrator membership, enforce application control to block untrusted executables and scripts, monitor and restrict use of msiexec.exe, and ensure EDR tamper protection is enabled. Unsupported Windows versions should be upgraded, isolated, or placed under a compensating-control plan because they may not reliably receive security fixes.

How to confirm the fix worked

Confirm remediation by checking that each affected Windows system has installed the relevant November 2021 or later cumulative security update that includes the fix, or the applicable later monthly cumulative update for that operating system. Validate through enterprise patch management, Windows Update history, Microsoft Update compliance reports, or local commands such as Get-HotFix, systeminfo, or Windows build/UBR inventory compared against Microsoft’s fixed update guidance. Confirm there are no unsupported or unmanaged Windows assets remaining in scope. Where feasible, run authenticated vulnerability scans with up-to-date plugins to verify CVE-2021-41379 is no longer reported. For golden images and offline templates, boot or mount them into the patch pipeline and confirm the same update baseline before redeployment.

Typical attack path

1. Gain an initial foothold on an affected Windows workstation or server as a low-privileged user.
2. Transfer or generate an exploit binary/script for the Windows Installer privilege escalation vulnerability.
3. Trigger the vulnerable Windows Installer behavior from the low-privileged context.
4. Obtain elevated local privileges, commonly SYSTEM or administrator-equivalent execution.
5. Run post-exploitation commands such as creating services, adding users to privileged groups, disabling security controls, or dumping credentials.
6. Use the elevated access to persist, move laterally, exfiltrate data, or deploy ransomware.

How to detect it

To determine whether the vulnerability was already exploited, review endpoint telemetry and Windows logs for suspicious privilege transitions involving Windows Installer activity. Useful sources include EDR process trees, Windows Security logs, Sysmon logs, Windows Installer logs, PowerShell logs, service control manager events, local group membership change events, scheduled task logs, and antivirus/EDR tamper alerts. Focus on cases where msiexec.exe or installer-related child processes are launched by non-administrative users, from user-writable directories such as Downloads, Temp, AppData, Desktop, or ProgramData, and are followed by SYSTEM-level cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, wscript.exe, cscript.exe, or service creation. Review Security Event ID 4688 for suspicious process creation, 4672 for special privileges assigned to a new logon, 4732/4733 for local Administrators group changes, 4720 for new user creation, 7045 in the System log for new service installation, 4698 for scheduled task creation, and 1102 for audit log clearing. Hunt for public exploit artifact names and post-exploitation behavior rather than relying on a single signature, because exploit implementations vary. Given ransomware association, also check for commands that disable defenses or recovery, such as vssadmin delete shadows, wbadmin delete catalog, bcdedit recovery changes, EDR/AV service stops, and mass file encryption activity after privilege escalation.

• msiexec.exe launched from a user-writable path
• \\AppData\\Local\\Temp\\msiexec.exe
• \\AppData\\Roaming\\msiexec.exe
• \\Users\\Public\\msiexec.exe
• \\ProgramData\\msiexec.exe
• msiexec.exe /quiet
• msiexec.exe /qn
• msiexec.exe /i http://
• msiexec.exe /i https://
• Event ID 4688
• Event ID 4672
• Event ID 4720
• Event ID 4732
• Event ID 4698
• Event ID 7045
• Event ID 1102
• AlwaysInstallElevated
• HKCU\\Software\\Policies\\Microsoft\\Windows\\Installer\\AlwaysInstallElevated
• HKLM\\Software\\Policies\\Microsoft\\Windows\\Installer\\AlwaysInstallElevated
• vssadmin delete shadows
• wbadmin delete catalog
• bcdedit /set {default} recoveryenabled no
• bcdedit /set {default} bootstatuspolicy ignoreallfailures
• net localgroup administrators
• net user /add
• sc.exe create
• schtasks /create
• wevtutil cl Security

What your security team should do

• Immediately identify all Windows systems that are missing the Microsoft security update for CVE-2021-41379, treating any remaining exposure as overdue because it is in CISA KEV and associated with ransomware activity.
• Patch or upgrade affected systems, prioritizing servers, privileged-access workstations, jump hosts, endpoints with broad network access, and systems used by administrators.
• Hunt for evidence of prior local privilege escalation, especially low-privileged user activity followed by SYSTEM-level command execution, suspicious msiexec.exe activity, new service creation, or local administrator group changes.
• Restrict execution of untrusted binaries and scripts using application control, attack surface reduction rules, and EDR policy controls.
• Review local administrator group membership and remove unnecessary privileged access across workstations and servers.
• Ensure endpoint protection, tamper protection, PowerShell logging, process creation logging, and Windows Installer logging are enabled and centrally collected.
• Investigate any endpoint showing Windows Installer activity followed by credential dumping, security tool disabling, backup deletion, or ransomware staging behavior.
• Retire, isolate, or apply Extended Security Updates to unsupported Windows versions that cannot receive current cumulative updates.