CVE-2021-34484: Microsoft Windows User Profile Service Elevation of Privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is confirmed exploited in the wild (CISA KEV) and affects a broad set of widely deployed Windows versions, though it requires local access and low privileges to exploit.

What it is

The Windows User Profile Service contains an elevation of privilege flaw that lets a local user gain higher privileges on the host. Microsoft rates it high severity (CVSS 7.8), and it affects a wide range of Windows client and server versions. Because it is listed in CISA's Known Exploited Vulnerabilities catalog, it is a confirmed target in real attacks.

Impact

A successful attacker gains full control of confidentiality, integrity and availability on the affected system, effectively escalating from a normal local user to SYSTEM or administrator level. This enables credential theft, persistence and further lateral movement.

Attack surface

The attack is local (AV:L) and requires low privileges (PR:L) with no user interaction (UI:N), meaning an attacker who already has a foothold or low-privileged account on the machine can trigger it. No remote network path or victim action is needed.

Exploitation

CVE-2021-34484 is in CISA's KEV catalog with a 2022-03-31 addition date, confirming active exploitation in the wild. EPSS gives a 30-day exploitation probability of about 21.8% (97.5th percentile), indicating high likelihood of continued targeting.

What to do

• Apply the Microsoft security update for CVE-2021-34484 on all affected Windows client and server versions as the primary fix.
• Prioritize patching of internet-facing and high-value systems, and treat any unpatched Windows 7, 8.1, Server 2008/2012 hosts as urgent due to lack of ongoing support.
• Restrict local logon and interactive access to only trusted users, since the flaw requires an existing low-privileged session.
• Monitor for and remove unnecessary local accounts and disable unused services that could provide an initial foothold.
• Verify patch deployment through vulnerability scanning and configuration management, and track exceptions to closure.

Detection

• Monitor Windows event logs for suspicious process creation or token manipulation originating from the User Profile Service (ProfSvc) or related user profile components.
• Alert on unexpected elevation of privilege events, such as processes gaining SYSTEM or administrator tokens from non-admin contexts.
• Hunt for known post-exploitation behavior following local privilege escalation, including creation of new admin accounts, service installation, or credential dumping tools.
• Use EDR telemetry to detect anomalous access to user profile registry keys or profile directories by low-privileged processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.