CVE-2021-33771: Windows Kernel Elevation of Privilege Flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is confirmed exploited in the wild and listed in CISA KEV, but requires local low-privileged access, limiting it to a post-compromise escalation role.

What it is

CVE-2021-33771 is an elevation of privilege vulnerability in the Windows kernel. A local attacker with low privileges can exploit it to gain full control of confidentiality, integrity and availability on the host. It affects a broad set of Windows 10, Windows 8.1, Windows RT 8.1 and Windows Server releases.

Impact

An attacker who exploits the flaw gains SYSTEM-level privileges from a low-privileged local context, enabling full compromise of the affected machine.

Attack surface

The CVSS vector AV:L/PR:L/UI:N indicates the flaw is reached locally by an authenticated low-privileged user with no user interaction. It is not remotely reachable over the network.

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming in-the-wild exploitation; EPSS gives a 30-day probability of roughly 10.2 percent (95th percentile). No ransomware campaign use is recorded.

What to do

• Apply the Microsoft security update for CVE-2021-33771 on all affected Windows 10, Windows 8.1, Windows RT 8.1 and Windows Server versions.
• Prioritize patching of systems where untrusted users have local logon or code execution, such as multi-user and remote-access hosts.
• Restrict local interactive and remote desktop access to only necessary accounts to reduce the pool of low-privileged users who can trigger the flaw.
• Monitor for and block unapproved kernel driver or exploit tooling execution on endpoints.

Detection

• Alert on processes that gain SYSTEM token or spawn from unexpected low-privileged parents, especially near kernel exploitation activity.
• Monitor for known public exploit artifacts and suspicious driver loads associated with Windows kernel privilege escalation.
• Correlate local privilege escalation events with subsequent credential access or lateral movement in EDR telemetry.
• Track patch state of the affected Windows builds against the vendor advisory to find unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.