CVE-2021-36948: Windows Update Medic Service elevation of privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with confirmed in-the-wild exploitation and high EPSS, but requires local access and low privileges, so it is a serious post-compromise escalation rather than a remote entry point.

What it is

CVE-2021-36948 is an elevation of privilege flaw in the Windows Update Medic Service affecting multiple Windows 10 and Windows Server builds. A local attacker with low privileges can exploit it to gain higher rights on the host, which matters because it turns limited access into full system control.

Impact

Successful exploitation gives the attacker high confidentiality, integrity and availability impact, effectively SYSTEM-level control of the affected machine. That access can be used to disable defenses, persist, or move laterally.

Attack surface

The vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker must already have code execution or an account on the target host. It is not remotely reachable and needs no victim action.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a 2021-11-17 remediation due date, indicating exploitation in the wild; EPSS is 0.2327 (97.7th percentile). No ransomware campaign use is recorded.

What to do

• Apply the Microsoft security update for CVE-2021-36948 on all affected Windows 10 and Windows Server builds immediately.
• Prioritize patching hosts where untrusted or low-privileged users already have local access.
• Restrict local logon and code execution rights to reduce the pool of accounts that can trigger the flaw.
• Monitor for and remove unpatched or end-of-life builds listed as affected.
• Verify patch compliance against the CISA KEV due date for any remaining systems.

Detection

• Alert on unexpected process creation or service manipulation involving the Windows Update Medic Service (WaaSMedicSvc).
• Monitor for privilege escalation indicators such as new SYSTEM-level processes spawned from low-privileged parent processes.
• Audit local account and token changes on affected hosts for signs of elevation.
• Track patch state of the listed Windows builds and flag unpatched endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.