CVE-2021-31201: Microsoft Enhanced Cryptographic Provider privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is confirmed exploited in CISA KEV and affects a broad set of Windows versions, though it requires local access and low privileges and has only medium CVSS severity.

What it is

CVE-2021-31201 is an elevation of privilege flaw in the Microsoft Enhanced Cryptographic Provider on Windows. The record gives no root-cause detail beyond the CWE being 'insufficient information', so the exact defect is unknown. It matters because it is listed in CISA's Known Exploited Vulnerabilities catalog, meaning it has been exploited in the wild.

Impact

A local attacker with low privileges can gain elevated rights on the affected system, with limited confidentiality and integrity impact and a scope change beyond the vulnerable component.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so an attacker must already have code execution or an account on the host. It is not remotely reachable over the network.

Exploitation

CISA added it to the KEV catalog on 2021-11-03 with a remediation due date of 2021-11-17, confirming known exploitation; EPSS 30-day probability is about 2.6 percent (84.7th percentile). No ransomware campaign use is recorded.

What to do

• Apply the Microsoft security update referenced in the vendor advisory for all listed Windows client and server versions.
• Prioritize patching internet-facing and high-value hosts, then complete fleet-wide remediation by the KEV due date.
• Restrict local logon and interactive access to only trusted users to reduce the pool of accounts that can trigger the flaw.
• Monitor for and remove unpatched or end-of-life builds such as Windows 7, Windows 8.1 and Windows Server 2008/2012 where feasible.

Detection

• Alert on unexpected privilege changes or token elevation events (for example Windows Security event IDs 4672 and 4688) from non-administrative processes.
• Hunt for processes loading or abusing crypt32/Enhanced Cryptographic Provider components outside normal signed system paths.
• Correlate local low-privilege process activity with subsequent administrative actions on the same host.
• Track patch compliance for the affected Windows builds and flag hosts still missing the June 2021 updates.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.