CVE-2021-41379: Windows Installer link-following elevation of privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a locally exploitable privilege escalation listed in CISA KEV with known ransomware use and a high EPSS percentile, though it requires an existing foothold and has a moderate CVSS base score.

What it is

CVE-2021-41379 is a link-following (CWE-59) flaw in the Microsoft Windows Installer that allows a local user to gain elevated privileges. It affects a broad set of Windows client and server releases, and Microsoft published patches in November 2021. Because it is a local privilege escalation with a known public exploit history, it is a standard step in post-compromise escalation and ransomware chains.

Impact

An attacker who already has a foothold on a host can escalate from a low-privileged account to SYSTEM or administrative rights. That level of access enables credential theft, disabling of defenses, and further lateral movement or ransomware deployment.

Attack surface

The vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker must already be able to run code on the target machine. It is not remotely reachable and does not require a victim to open a file or click anything.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-03 with a due date of 2022-03-17 and flags known ransomware campaign use. EPSS gives a 30-day exploitation probability of about 19.5 percent (97th percentile), and references include vendor patch advisories and a third-party advisory.

What to do

• Apply the Microsoft security updates for CVE-2021-41379 on all affected Windows client and server versions; prioritize internet-facing and high-value hosts.
• Track remediation against the CISA KEV due date and confirm patched status rather than relying on version strings alone.
• Restrict local interactive and service logon rights to the minimum necessary to reduce the pool of accounts that can trigger the flaw.
• Monitor for and block untrusted MSI/installer execution and unexpected writes to privileged installer paths where feasible.

Detection

• Hunt for unexpected child processes spawned by msiexec.exe or the Windows Installer service, especially those running as SYSTEM.
• Alert on creation of files or directories in privileged installer-related paths by non-administrative users.
• Correlate local privilege escalation activity with subsequent credential dumping, defense evasion, or ransomware precursor behavior.
• Review Windows Installer and process creation logs for anomalous installer activity on hosts where low-privileged users can execute code.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.