CVE-2021-34486: Windows Event Tracing use-after-free privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a locally exploitable use-after-free with high impact that CISA lists as exploited in the wild, though it requires an existing low-privileged foothold.

What it is

CVE-2021-34486 is a use-after-free (CWE-416) in Windows Event Tracing that allows a local user to elevate privileges. It affects multiple Windows 10 and Windows Server builds, and Microsoft patched it in August 2021. Because it is a local privilege escalation with high confidentiality, integrity and availability impact, it is a valuable post-compromise step for attackers already on a host.

Impact

A local attacker who can run code on a vulnerable system can exploit the use-after-free to gain elevated privileges, typically SYSTEM. That gives full control over the host, including access to other users' data and the ability to disable security controls.

Attack surface

The CVSS vector is AV:L/PR:L/UI:N, so the flaw is reached locally by an authenticated low-privileged user and requires no user interaction. No remote or network vector is described in the record.

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2022-03-28, indicating exploitation in the wild; EPSS 30-day probability is about 9.25 percent (95th percentile). The record does not list known ransomware campaign use.

What to do

• Apply the Microsoft August 2021 security updates for all affected Windows 10 and Windows Server builds listed in the advisory.
• Prioritize patching of systems where multiple users share local access or where low-privileged accounts are common.
• Restrict local logon and interactive access to only trusted users to reduce the pool of potential local attackers.
• Monitor for and remove unnecessary local accounts and limit administrative tooling that could be used after elevation.

Detection

• Monitor for unexpected creation of SYSTEM-level processes or services originating from non-administrative user sessions.
• Audit Windows Event Tracing (ETW) related process activity and look for unusual access to ETW components by low-privileged processes.
• Correlate local privilege escalation indicators such as token manipulation or suspicious service creation with recent logons by non-admin users.
• Track exploitation attempts against unpatched hosts by reviewing endpoint telemetry for crashes or anomalous behavior in ETW-related processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.