CVE-2021-1675: Windows Print Spooler remote code execution (PrintNightmare)

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, has a very high EPSS score, public exploit code, and affects a default Windows service across a wide product range.

What it is

CVE-2021-1675 is a remote code execution flaw in the Microsoft Windows Print Spooler service, widely known as PrintNightmare. The record gives only a one-line description and no root-cause detail, but the flaw allows code execution in the context of the Spooler service, which runs with elevated privileges on affected Windows client and server versions. It matters because the Spooler is present by default on a very broad set of Windows 10, Windows 7, Windows 8.1 and Windows Server releases.

Impact

An attacker who successfully exploits the flaw gains code execution with the privileges of the Print Spooler service, which is SYSTEM on most configurations. That level of access enables full compromise of the host, including credential theft and lateral movement.

Attack surface

The NVD vector is AV:L/AC:L/PR:N/UI:R, so the scored path is local with no privileges required but user interaction needed; the description and public references describe remote exploitation of the Spooler service as well. No authentication is required on the scored vector, and the record does not specify which Spooler interfaces are reachable remotely.

Exploitation

CISA added this CVE to the KEV catalog on 2021-11-03 with a 2021-11-17 remediation due date and flags known ransomware campaign use. EPSS gives a 30-day exploitation probability of 0.861 (99.7th percentile), and references include public proof-of-concept and exploit material.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2021-1675 on all affected Windows client and server versions.
• Disable the Print Spooler service on hosts that do not need to print, especially domain controllers and internet-facing servers.
• Restrict who can install printer drivers and block point-and-print driver installation via Group Policy where operationally possible.
• Segment and monitor print servers, and limit inbound SMB/RPC access to Spooler-related services from untrusted networks.
• Verify KEV remediation due date compliance (2021-11-17) and confirm patched status across the full affected product list.

Detection

• Monitor for Spooler service crashes or unexpected restarts (spoolsv.exe) and for new printer driver or DLL files written to spool/driver directories.
• Alert on suspicious print spooler API activity, including AddPrinterDriver and RpcAddPrinterDriverEx calls from unusual processes or remote hosts.
• Hunt for SYSTEM-level child processes spawned by spoolsv.exe, which is abnormal for normal printing operations.
• Review Windows event logs and Sysmon for driver load events and file creation in print spooler paths on servers and workstations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.