CVE-2021-31199: Microsoft Enhanced Cryptographic Provider local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is listed in CISA KEV as exploited in the wild and affects a wide range of Windows versions, though it requires local low-privileged access and has only medium CVSS severity.

What it is

CVE-2021-31199 is an elevation of privilege flaw in the Microsoft Enhanced Cryptographic Provider affecting a broad set of Windows client and server releases. The record gives no root-cause detail beyond the component name, so the exact defect is unknown, but a local attacker with low privileges can exploit it to gain additional rights on the host.

Impact

An attacker who already has a foothold and low-privileged code execution can elevate to a higher integrity level on the affected Windows system. The scope change in the CVSS vector indicates the impact can cross a security boundary, though confidentiality and integrity effects are rated low.

Attack surface

The vector AV:L/AC:L/PR:L/UI:N means the flaw is reached locally, requires low privileges, and needs no user interaction. It is not remotely exploitable on its own; an attacker must already be running code on the target machine.

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a remediation due date of 2021-11-17, indicating exploitation in the wild. EPSS gives a 30-day exploitation probability of about 2.95 percent (86th percentile), and no ransomware campaign use is recorded.

What to do

• Apply the Microsoft security update for CVE-2021-31199 on all affected Windows client and server versions; this is the primary fix.
• Prioritize patching systems where untrusted users or low-privileged processes can execute code, since exploitation requires local access.
• Restrict interactive logon and code execution rights to the minimum necessary to reduce the pool of accounts that can trigger the flaw.
• Monitor for and remove unpatched or end-of-life Windows builds listed as affected, such as Windows 7 and Windows Server 2008/2012, where feasible.

Detection

• Hunt for unexpected elevation of low-privileged processes to higher integrity levels, especially involving cryptographic provider DLLs or services.
• Alert on suspicious process creation where a medium-integrity process spawns a high-integrity or SYSTEM-level child process outside normal administrative workflows.
• Review Windows security event logs for anomalous token or privilege changes on hosts running affected Windows versions.
• Correlate local privilege escalation indicators with known post-exploitation tooling behavior on endpoints that have not applied the June 2021 updates.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.