CVE-2021-36942: Windows LSA spoofing allows credential relay and NTLM coercion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityIt is in CISA KEV with known ransomware use, has a very high EPSS score, and enables full domain compromise without authentication.

What it is

CVE-2021-36942 is a spoofing flaw in the Windows Local Security Authority (LSA) affecting multiple Windows Server releases. It is the vulnerability patched alongside the PetitPotam NTLM relay technique, which lets an unauthenticated attacker coerce a domain controller to authenticate to an attacker-controlled host and relay that authentication. Because it enables full domain takeover in common configurations, it is a high-value target for ransomware operators.

Impact

An attacker who relays the coerced authentication can impersonate a domain controller and obtain domain controller certificates or machine account credentials, leading to full Active Directory compromise. The CVSS vector indicates high confidentiality impact with no integrity or availability impact from the flaw itself.

Attack surface

Reachable over the network with no authentication and no user interaction (AV:N/AC:L/PR:N/UI:N). The attacker only needs network access to the target and a service that can be coerced into authenticating, such as the EFSRPC interface.

Exploitation

Listed in CISA KEV with a due date of 2021-11-17 and flagged for known ransomware campaign use; EPSS 30-day probability is 0.66023 (99.2nd percentile). A public exploit reference is available via the CERT/CC advisory.

What to do

• Apply the Microsoft August 2021 security updates for all affected Windows Server versions immediately.
• Disable or restrict NTLM authentication where feasible and enforce Extended Protection for Authentication and SMB signing.
• Block the EFSRPC and related coercion vectors at the network perimeter and between internal segments.
• Enable Active Directory Certificate Services protections, including requiring strong certificate mapping and disabling vulnerable enrollment endpoints.
• Monitor for and rotate any domain controller or machine account credentials that may have been relayed.

Detection

• Alert on unexpected NTLM authentication attempts to domain controllers from non-domain-controller hosts.
• Monitor for EFSRPC or similar RPC calls originating from untrusted systems.
• Audit certificate enrollment events for anomalous domain controller certificate requests.
• Correlate KEV-listed exploitation indicators with endpoint and network telemetry for relay activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.