CVE-2021-43226

What it actually does

CVE-2021-43226 is a local elevation-of-privilege vulnerability in the Windows Common Log File System driver, clfs.sys. An attacker who can already execute code as a low-privileged user on an affected Windows workstation or server can trigger the vulnerable kernel driver with crafted input and escalate privileges, commonly to NT AUTHORITY\SYSTEM. Because the flaw is in a kernel-mode Windows component, successful exploitation can give the attacker high levels of confidentiality, integrity, and availability impact, including the ability to tamper with security controls, access protected data, and execute arbitrary code with elevated privileges.

Why it matters to the business

This vulnerability does not provide initial remote access by itself, but it is highly valuable after an attacker has gained a foothold because it can turn limited access into full control of a Windows system. It is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation due date of 2025-10-27, indicating confirmed exploitation in the wild and requiring urgent prioritization despite a modest EPSS score. Unpatched Windows endpoints and servers may allow intruders to disable security tooling, dump credentials, move laterally, deploy malware, or disrupt business operations.

How an attack unfolds

An attacker first obtains local code execution on an affected Windows system through another vector such as phishing, stolen credentials, exposed remote access, malware delivery, or exploitation of a separate service vulnerability. With low-privileged access, the attacker runs a purpose-built exploit that interacts with the Windows Common Log File System driver. The exploit supplies crafted CLFS-related input that causes the kernel driver to mishandle memory or object state, allowing the attacker to manipulate kernel execution or security tokens. After the privilege escalation succeeds, the attacker runs commands or spawns a process as SYSTEM, then typically disables protections, extracts credentials, installs persistence, or uses the compromised host to access additional systems. Public reporting and KEV status indicate active in-the-wild exploitation of this Windows privilege escalation class, so defenders should treat suspicious post-compromise privilege changes on unpatched systems as potentially related.

How to fix it

Apply the relevant Microsoft security updates that address CVE-2021-43226 across all affected Windows versions, including Windows 10, Windows 11, Windows 7, Windows 8.1, Windows RT 8.1, and supported Windows Server releases including 2008, 2012, 2016, and 2019 where applicable. Because no fixed versions were provided in the input, use Microsoft Update, WSUS, Microsoft Update Catalog, or enterprise patch management to confirm the December 2021 or later cumulative security update level for each affected operating system. Systems that are out of support, such as Windows 7 or older Windows Server releases without Extended Security Updates, should be upgraded, isolated, or decommissioned. Compensating controls include restricting local interactive access, limiting who can run code on servers, enforcing application control, reducing local administrator rights, monitoring for privilege escalation behavior, and ensuring endpoint protection has tamper protection enabled; however, these controls should not be treated as substitutes for patching.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows host has installed the Microsoft cumulative security update that includes the December 2021 fix or a later superseding update. Validate patch status through Windows Update history, enterprise patch inventory, vulnerability scanners, or PowerShell-based checks such as querying installed hotfixes and build numbers. Confirm that clfs.sys has been updated to the version shipped with the applicable fixed cumulative update for the operating system. Re-scan with authenticated vulnerability scanning to ensure CVE-2021-43226 is no longer reported. For unsupported operating systems, confirm that the system has been upgraded, removed from production, or placed behind strong isolation with documented risk acceptance.

Typical attack path

1. Gain an initial foothold on an affected Windows workstation or server using a separate technique such as phishing, malware, stolen credentials, RDP access, or exploitation of another vulnerability.
2. Execute a local exploit binary or script from a low-privileged user context.
3. Trigger the vulnerable Windows Common Log File System driver, clfs.sys, using crafted CLFS-related input.
4. Exploit the kernel-mode flaw to obtain elevated privileges, commonly SYSTEM-level execution.
5. Launch an elevated shell, service, scheduled task, or payload under the higher-privileged security context.
6. Disable or tamper with endpoint defenses, collect credentials, establish persistence, and move laterally or conduct follow-on operations.

How to detect it

Detection should focus on evidence of local privilege escalation and follow-on activity, because exploitation occurs locally and may not leave a unique network signature. Review endpoint telemetry, Sysmon, Windows Security logs, EDR process lineage, driver crash data, and application control logs on affected or recently patched Windows hosts. Look for low-privileged user processes that unexpectedly create SYSTEM-level processes, services, scheduled tasks, or command shells. Investigate unusual execution from writable locations such as user profile directories, Temp folders, Downloads, ProgramData, or public directories followed by elevated activity. Review Windows Security Event ID 4688 for suspicious process creation, Event ID 4672 for special privileges assigned to a new logon, Event ID 4624 for unusual local or remote logons, Event ID 7045 in the System log for new service installation, and Task Scheduler operational logs for newly registered tasks. Check for crashes or instability involving clfs.sys around the time of suspicious privilege changes, but absence of a crash does not rule out exploitation. Hunt for post-exploitation behaviors such as LSASS access, credential dumping tools, disabling antivirus or EDR services, creation of new local administrators, modifications to Windows Defender exclusions, and lateral movement shortly after an unprivileged process runs. There are no reliable public file hashes or network indicators that uniquely identify exploitation of this vulnerability across environments, so behavior-based detection and patch-state correlation are the most reliable approaches.

• C:\Windows\System32\drivers\clfs.sys
• clfs.sys
• NT AUTHORITY\SYSTEM
• Event ID 4672
• Event ID 4688
• Event ID 7045
• Microsoft-Windows-TaskScheduler/Operational
• C:\Users\Public\
• C:\ProgramData\
• \AppData\Local\Temp\
• \Downloads\
• vssadmin delete shadows
• wmic shadowcopy delete
• powershell Set-MpPreference -DisableRealtimeMonitoring $true
• Add-MpPreference -ExclusionPath
• reg add HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
• net localgroup administrators
• schtasks /create
• sc.exe create
• lsass.exe

What your security team should do

• Prioritize patching immediately because the vulnerability is in the CISA Known Exploited Vulnerabilities catalog and has confirmed in-the-wild exploitation, with a CISA remediation due date of 2025-10-27.
• Inventory all Windows workstations and servers, including legacy and embedded systems, and identify hosts missing December 2021 or later cumulative security updates.
• Patch internet-facing, user-facing, administrator workstations, domain-joined systems, remote access servers, and high-value Windows servers first.
• Upgrade, isolate, or retire unsupported Windows versions that cannot receive the relevant security update.
• Hunt for signs of post-exploitation privilege escalation on unpatched or recently patched systems, especially low-privileged processes spawning SYSTEM-level shells, services, scheduled tasks, or security tooling changes.
• Review endpoint detection and response alerts for kernel exploit behavior, suspicious CLFS driver crash activity, abnormal token manipulation, credential dumping, and defense evasion following low-privileged user activity.
• Restrict local code execution paths using application control, least privilege, attack surface reduction rules, and controlled folder or script execution policies where operationally feasible.
• Correlate this vulnerability with other initial-access exposures, because attackers commonly pair local privilege escalation vulnerabilities with phishing, webshells, stolen credentials, or remote access compromise.