Read the docs
TI-2021-09476 Aliases CVE-2021-28313GHSA-fc33-vqf4-q4x8

Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability

Priority LOW 36CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability

Why it matters now

EPSS 0.01039 64th percentileScored 2026-11-07
Fix Fixed Windows 10 Version 1803 (Microsoft): publicationWindows 10 Version 1809 (Microsoft): publication+13 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftWindows 10 Version 180310.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows 10 Version 180910.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server 201910.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server 2019 (Server Core installation)10.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows 10 Version 190910.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server, version 1909 (Server Core installation)10.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows 10 Version 200410.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server version 200410.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows 10 Version 20H210.0.0 to before publicationpublicationPatch availableCNA
MicrosoftWindows Server version 20H210.0.0 to before publicationpublicationPatch availableCNA
MicrosoftMicrosoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)15.0.0 to before publicationpublicationPatch availableCNA
MicrosoftMicrosoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)15.9.0 to before publicationpublicationPatch availableCNA
MicrosoftMicrosoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)16.0 to before publicationpublicationPatch availableCNA
MicrosoftMicrosoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)16.0.0 to before publicationpublicationPatch availableCNA
MicrosoftMicrosoft Visual Studio 2015 Update 314.0.0 to before publicationpublicationPatch availableCNA
  • Windows 10 Version 1803 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows 10 Version 1809 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows Server 2019 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows Server 2019 (Server Core installation) VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows 10 Version 1909 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows Server, version 1909 (Server Core installation) VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows 10 Version 2004 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows Server version 2004 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows 10 Version 20H2 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Windows Server version 20H2 VendorMicrosoft Affected 10.0.0 to before publication Fixed in publication Patch available CNA
  • Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) VendorMicrosoft Affected 15.0.0 to before publication Fixed in publication Patch available CNA
  • Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) VendorMicrosoft Affected 15.9.0 to before publication Fixed in publication Patch available CNA
  • Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) VendorMicrosoft Affected 16.0 to before publication Fixed in publication Patch available CNA
  • Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
  • Microsoft Visual Studio 2015 Update 3 VendorMicrosoft Affected 14.0.0 to before publication Fixed in publication Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:visual_studio:2015:update3:*:*:*:*:*:*2015 update3VulnerableMicrosoft
cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:*15.0 – 15.9VulnerableMicrosoft
cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*16.0 – 16.7; 16.8 – 16.9VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:*20h2VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*1803VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*1809VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*1909VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*2004VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:20h2:*:*:*:*:*:*:*20h2VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*1909VulnerableMicrosoft
  • cpe:2.3:a:microsoft:visual_studio:2015:update3:*:*:*:*:*:* Versions 2015 update3 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:* Versions 15.0 – 15.9 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:* Versions 16.0 – 16.7; 16.8 – 16.9 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:* Versions 20h2 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:* Versions 1803 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* Versions 1809 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:* Versions 1909 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:* Versions 2004 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:20h2:*:*:*:*:*:*:* Versions 20h2 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:* Versions 1909 Vulnerable ·Microsoft
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*2004VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:* Versions 2004 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft

Remediation

  • Fix · CNA Windows 10 Version 1803 (Microsoft) Fixed in publication
  • Fix · CNA Windows 10 Version 1809 (Microsoft) Fixed in publication
  • Fix · CNA Windows Server 2019 (Microsoft) Fixed in publication
  • Fix · CNA Windows Server 2019 (Server Core installation) (Microsoft) Fixed in publication
  • Fix · CNA Windows 10 Version 1909 (Microsoft) Fixed in publication
  • Fix · CNA Windows Server, version 1909 (Server Core installation) (Microsoft) Fixed in publication
  • Fix · CNA Windows 10 Version 2004 (Microsoft) Fixed in publication
  • Fix · CNA Windows Server version 2004 (Microsoft) Fixed in publication
  • Fix · CNA Windows 10 Version 20H2 (Microsoft) Fixed in publication
  • Fix · CNA Windows Server version 20H2 (Microsoft) Fixed in publication
  • Fix · CNA Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) (Microsoft) Fixed in publication
  • Fix · CNA Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) (Microsoft) Fixed in publication
  • Fix · CNA Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) (Microsoft) Fixed in publication
  • Fix · CNA Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) (Microsoft) Fixed in publication
  • Fix · CNA Microsoft Visual Studio 2015 Update 3 (Microsoft) Fixed in publication

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-28313
  2. 2026-10-03 Alias added: GHSA-fc33-vqf4-q4x8

References

Patch 1

Advisory 2

  • TI-2022-16266 Visual Studio Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2008-03546 Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69… CVSS 2.0HIGH 9.3
  • TI-2009-02381 The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio… CVSS 3.1HIGH 8.8
  • TI-2009-00858 The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio… CVSS 3.1HIGH 8.8
  • TI-2009-02389 Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2… CVSS 2.0HIGH 9.3
  • TI-2009-02388 Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3… CVSS 2.0HIGH 9.3
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences