CVE-2021-36955: Windows CLFS Driver Elevation of Privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a locally exploitable elevation of privilege flaw with a CVSS of 7.8, listed in CISA KEV with known ransomware use, though it requires existing low-privileged access.

What it is

The Windows Common Log File System (CLFS) driver contains an elevation of privilege flaw. A local attacker with low privileges can exploit it to gain higher privileges on the host, which matters because CLFS is a core Windows component present across many supported versions.

Impact

An attacker gains elevated privileges on the affected Windows system, potentially reaching SYSTEM-level access. That access can be used to disable security controls, install persistence, or move laterally.

Attack surface

The flaw is reached locally (CVSS vector AV:L) by an attacker who already holds low privileges (PR:L); no user interaction is required (UI:N). It is not remotely reachable and does not require a user to open a file or click a link.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a due date of 2021-11-17 and flags known ransomware campaign use. EPSS 30-day probability is about 4.0 percent (90th percentile), and references are patch and vendor advisory only.

What to do

• Apply the Microsoft security update for CVE-2021-36955 on all affected Windows client and server versions.
• Prioritize patching systems where low-privileged local access is broadly available, such as multi-user and remote desktop hosts.
• Restrict interactive logon and local account privileges to reduce the pool of accounts that can trigger the flaw.
• Monitor for and remove unpatched or end-of-life Windows versions listed as affected.
• Track CISA KEV remediation deadlines and confirm closure of the 2021-11-17 due date.

Detection

• Alert on unexpected privilege escalation to SYSTEM or high-integrity tokens originating from non-administrative processes.
• Monitor CLFS-related file and registry activity in system paths for anomalous writes or creations by low-privileged users.
• Correlate local logon events with subsequent privileged process creation on the same host.
• Review endpoint telemetry for known CLFS exploitation patterns and post-exploitation tooling consistent with ransomware staging.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.