CVE-2021-36934: Windows SAM database ACL flaw allows local privilege escalation to SYSTEM

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is in CISA KEV with a very high EPSS score and yields SYSTEM privileges, but exploitation requires an attacker to already have local code execution.

What it is

Overly permissive Access Control Lists on multiple Windows system files, including the Security Accounts Manager (SAM) database, let a local user read sensitive credential material. Because the flaw exposes the SAM and related files, an attacker with code execution on the host can escalate to SYSTEM and take full control of the machine.

Impact

An attacker gains SYSTEM-level privileges, enabling arbitrary code execution, installation of programs, viewing or modifying data, and creation of new accounts with full user rights. The exposed SAM data also provides credential material useful for lateral movement.

Attack surface

The vulnerability is local (CVSS vector AV:L) and requires the attacker to already have the ability to execute code on the victim system; no user interaction is needed and the attacker operates with low privileges (PR:L). It is not remotely reachable.

Exploitation

CVE-2021-36934 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10) and has a high EPSS 30-day probability of 0.67252 (99.265th percentile), indicating active exploitation in the wild. Public exploit code is referenced (HiveNightmare/SeriousSAM), though no ransomware group is documented as using it.

What to do

• Apply the Microsoft security update for CVE-2021-36934 as soon as possible.
• After patching, manually delete all shadow copies of system files, including the SAM database, per KB5005357; installing the update alone does not fully mitigate the issue.
• Restrict local interactive logon and code execution rights to only trusted users, since exploitation requires the ability to run code on the host.
• Monitor and limit use of Volume Shadow Copy Service where it is not operationally required.

Detection

• Monitor for unusual access or copy operations against SAM, SYSTEM, and SECURITY registry hive files and shadow copies.
• Alert on creation of Volume Shadow Copies outside normal backup windows or by non-administrative processes.
• Hunt for processes reading \Windows\System32\config\SAM or shadow copy paths from non-privileged contexts.
• Review Windows event logs for privilege escalation or new account creation following suspicious local file access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.