CVE-2021-41357: Microsoft Win32k Elevation of Privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a confirmed exploited-in-the-wild local privilege escalation with a CVSS of 7.8, though exploitation requires an existing foothold and the EPSS score is modest.

What it is

CVE-2021-41357 is an elevation of privilege flaw in the Windows Win32k kernel component affecting multiple Windows 10, Windows 11 and Windows Server releases. The record gives no root-cause detail beyond the CWE being 'insufficient information', so the exact defect is unknown, but Win32k privilege escalation flaws typically let a local user gain kernel-level rights. It matters because it was added to CISA's Known Exploited Vulnerabilities catalog, meaning it was exploited in the wild.

Impact

A local attacker who runs code on a vulnerable host can elevate from a low-privileged account to SYSTEM or kernel level, gaining full control of the machine. That enables credential theft, disabling of security controls and lateral movement.

Attack surface

The CVSS vector is AV:L/PR:L/UI:N, so the flaw is reached locally by an authenticated low-privileged user with no user interaction. It is not remotely reachable and requires the attacker to already have code execution or an interactive session on the target.

Exploitation

CISA added it to the KEV catalog on 2022-04-25 with a remediation due date of 2022-05-16, confirming known exploitation; EPSS is low at roughly 2.1 percent (80th percentile) and no ransomware campaign use is recorded.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2021-41357 on all affected Windows 10, Windows 11 and Windows Server builds.
• Prioritize patching of internet-facing and multi-user systems such as terminal servers and jump hosts where local privilege escalation is most valuable.
• Enforce least privilege so users do not run with administrative rights, limiting the value of a local escalation.
• Enable and monitor Windows Defender Credential Guard and other kernel hardening features to reduce post-exploitation impact.

Detection

• Monitor for unexpected creation of SYSTEM-level processes or services spawned from low-privileged user sessions.
• Alert on suspicious token manipulation or privilege escalation attempts against win32k.sys via EDR kernel telemetry.
• Correlate local logon events with subsequent high-integrity process creation on hosts that have not been patched.
• Track patch compliance for the affected Windows builds and flag unpatched endpoints as high risk.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.