Read the docs
TI-2021-13550 Aliases CVE-2021-34527GHSA-75f9-mm5v-2rgm

Windows Print Spooler Remote Code Execution Vulnerability

Priority CRITICAL 97Exploited in the wildPublished · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Microsoft. Impact type from Microsoft.

Summary

A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. UPDATE July 7, 2021: The security update for Windows Server 2012, Windows Server 2016 and Windows 10, Version 1607 have been released. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. If you are unable to install these updates, see the FAQ and Workaround sections in this CVE for information on how to help protect your system from this vulnerability. In addition to installing the updates, in order to secure your system, you must confirm that the following registry settings are set to 0 (zero) or are not defined (Note: These registry keys do not exist by default, and therefore are already at the secure setting.), also that your Group Policy setting are correct (see FAQ): HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint NoWarningNoElevationOnInstall = 0 (DWORD) or not defined (default setting) UpdatePromptSettings = 0 (DWORD) or not defined (default setting) Having NoWarningNoElevationOnInstall set to 1 makes your system vulnerable by design. UPDATE July 6, 2021: Microsoft has completed the investigation and has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. If you are unable to install these updates, see the FAQ and Workaround sections in this CVE for information on how to help protect your system from this vulnerability. See also KB5005010: Restricting installation of new printer drivers after applying the July 6, 2021 updates. Note that the security updates released on and after July 6, 2021 contain protections for CVE-2021-1675 and the additional remote code execution exploit in the Windows Print Spooler service known as “PrintNightmare”, documented in CVE-2021-34527.

Why it matters now

Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03Known ransomware use
EPSS 0.99792 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed Microsoft: 17 updates

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftWindows 10 Version 150710.0.10240.0 to before 10.0.10240.1896910.0.10240.18969Patch availableCNA
MicrosoftWindows 10 Version 160710.0.14393.0 to before 10.0.14393.447010.0.14393.4470Patch availableCNA
MicrosoftWindows 10 Version 180910.0.17763.0 to before 10.0.17763.202910.0.17763.2029Patch availableCNA
MicrosoftWindows 10 Version 180910.0.0 to before 10.0.17763.202910.0.17763.2029Patch availableCNA
MicrosoftWindows 10 Version 20H210.0.0 to before 10.0.19042.108310.0.19042.1083Patch availableCNA
MicrosoftWindows 10 Version 21H210.0.19044.0 to before 10.0.19044.141510.0.19044.1415Patch availableCNA
MicrosoftWindows 10 Version 22H210.0.19045.0 to before 10.0.19045.225110.0.19045.2251Patch availableCNA
MicrosoftWindows 11 version 21H210.0.22000.0 to before 10.0.22000.31810.0.22000.318Patch availableCNA
MicrosoftWindows 11 version 22H210.0.22621.0 to before 10.0.22621.67410.0.22621.674Patch availableCNA
MicrosoftWindows 8.16.3.0 to before 6.3.9600.200466.3.9600.20046Patch availableCNA
MicrosoftWindows Server 2008 R2 Service Pack 16.1.7601.0 to before 6.1.7601.256336.1.7601.25633Patch availableCNA
MicrosoftWindows Server 2008 R2 Service Pack 1 (Server Core installation)6.1.7601.0 to before 6.1.7601.256336.1.7601.25633Patch availableCNA
MicrosoftWindows Server 2008 Service Pack 26.0.6003.0 to before 6.0.6003.211386.0.6003.21138Patch availableCNA
MicrosoftWindows Server 2008 Service Pack 2 (Server Core installation)6.0.6003.0 to before 6.0.6003.211386.0.6003.21138Patch availableCNA
MicrosoftWindows Server 20126.2.9200.0 to before 6.2.9200.233836.2.9200.23383Patch availableCNA
MicrosoftWindows Server 2012 (Server Core installation)6.2.9200.0 to before 6.2.9200.233836.2.9200.23383Patch availableCNA
MicrosoftWindows Server 2012 R26.3.9600.0 to before 6.3.9600.200466.3.9600.20046Patch availableCNA
MicrosoftWindows Server 2012 R2 (Server Core installation)6.3.9600.0 to before 6.3.9600.200466.3.9600.20046Patch availableCNA
MicrosoftWindows Server 201610.0.14393.0 to before 10.0.14393.447010.0.14393.4470Patch availableCNA
MicrosoftWindows Server 2016 (Server Core installation)10.0.14393.0 to before 10.0.14393.447010.0.14393.4470Patch availableCNA
MicrosoftWindows Server 201910.0.17763.0 to before 10.0.17763.202910.0.17763.2029Patch availableCNA
MicrosoftWindows Server 2019 (Server Core installation)10.0.17763.0 to before 10.0.17763.202910.0.17763.2029Patch availableCNA
MicrosoftWindows Server 202210.0.20348.0 to before 10.0.20348.23010.0.20348.230Patch availableCNA
MicrosoftWindows Server version 20H210.0.0 to before 10.0.19042.108310.0.19042.1083Patch availableCNA
  • Windows 10 Version 1507 VendorMicrosoft Affected 10.0.10240.0 to before 10.0.10240.18969 Fixed in 10.0.10240.18969 Patch available CNA
  • Windows 10 Version 1607 VendorMicrosoft Affected 10.0.14393.0 to before 10.0.14393.4470 Fixed in 10.0.14393.4470 Patch available CNA
  • Windows 10 Version 1809 VendorMicrosoft Affected 10.0.17763.0 to before 10.0.17763.2029 Fixed in 10.0.17763.2029 Patch available CNA
  • Windows 10 Version 1809 VendorMicrosoft Affected 10.0.0 to before 10.0.17763.2029 Fixed in 10.0.17763.2029 Patch available CNA
  • Windows 10 Version 20H2 VendorMicrosoft Affected 10.0.0 to before 10.0.19042.1083 Fixed in 10.0.19042.1083 Patch available CNA
  • Windows 10 Version 21H2 VendorMicrosoft Affected 10.0.19044.0 to before 10.0.19044.1415 Fixed in 10.0.19044.1415 Patch available CNA
  • Windows 10 Version 22H2 VendorMicrosoft Affected 10.0.19045.0 to before 10.0.19045.2251 Fixed in 10.0.19045.2251 Patch available CNA
  • Windows 11 version 21H2 VendorMicrosoft Affected 10.0.22000.0 to before 10.0.22000.318 Fixed in 10.0.22000.318 Patch available CNA
  • Windows 11 version 22H2 VendorMicrosoft Affected 10.0.22621.0 to before 10.0.22621.674 Fixed in 10.0.22621.674 Patch available CNA
  • Windows 8.1 VendorMicrosoft Affected 6.3.0 to before 6.3.9600.20046 Fixed in 6.3.9600.20046 Patch available CNA
  • Windows Server 2008 R2 Service Pack 1 VendorMicrosoft Affected 6.1.7601.0 to before 6.1.7601.25633 Fixed in 6.1.7601.25633 Patch available CNA
  • Windows Server 2008 R2 Service Pack 1 (Server Core installation) VendorMicrosoft Affected 6.1.7601.0 to before 6.1.7601.25633 Fixed in 6.1.7601.25633 Patch available CNA
  • Windows Server 2008 Service Pack 2 VendorMicrosoft Affected 6.0.6003.0 to before 6.0.6003.21138 Fixed in 6.0.6003.21138 Patch available CNA
  • Windows Server 2008 Service Pack 2 (Server Core installation) VendorMicrosoft Affected 6.0.6003.0 to before 6.0.6003.21138 Fixed in 6.0.6003.21138 Patch available CNA
  • Windows Server 2012 VendorMicrosoft Affected 6.2.9200.0 to before 6.2.9200.23383 Fixed in 6.2.9200.23383 Patch available CNA
  • Windows Server 2012 (Server Core installation) VendorMicrosoft Affected 6.2.9200.0 to before 6.2.9200.23383 Fixed in 6.2.9200.23383 Patch available CNA
  • Windows Server 2012 R2 VendorMicrosoft Affected 6.3.9600.0 to before 6.3.9600.20046 Fixed in 6.3.9600.20046 Patch available CNA
  • Windows Server 2012 R2 (Server Core installation) VendorMicrosoft Affected 6.3.9600.0 to before 6.3.9600.20046 Fixed in 6.3.9600.20046 Patch available CNA
  • Windows Server 2016 VendorMicrosoft Affected 10.0.14393.0 to before 10.0.14393.4470 Fixed in 10.0.14393.4470 Patch available CNA
  • Windows Server 2016 (Server Core installation) VendorMicrosoft Affected 10.0.14393.0 to before 10.0.14393.4470 Fixed in 10.0.14393.4470 Patch available CNA
  • Windows Server 2019 VendorMicrosoft Affected 10.0.17763.0 to before 10.0.17763.2029 Fixed in 10.0.17763.2029 Patch available CNA
  • Windows Server 2019 (Server Core installation) VendorMicrosoft Affected 10.0.17763.0 to before 10.0.17763.2029 Fixed in 10.0.17763.2029 Patch available CNA
  • Windows Server 2022 VendorMicrosoft Affected 10.0.20348.0 to before 10.0.20348.230 Fixed in 10.0.20348.230 Patch available CNA
  • Windows Server version 20H2 VendorMicrosoft Affected 10.0.0 to before 10.0.19042.1083 Fixed in 10.0.19042.1083 Patch available CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*before 10.0.10240.18969VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*before 10.0.14393.4470VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*before 10.0.17763.2029VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*before 10.0.19042.1083VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*before 10.0.19044.1415VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*before 10.0.19045.2251VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*before 10.0.22000.318VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*before 10.0.22621.674VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:* Versions before 10.0.10240.18969 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:* Versions before 10.0.14393.4470 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:* Versions before 10.0.17763.2029 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:* Versions before 10.0.19042.1083 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* Versions before 10.0.19044.1415 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* Versions before 10.0.19045.2251 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* Versions before 10.0.22000.318 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* Versions before 10.0.22621.674 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*r2 sp1VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*r2VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*before 10.0.14393.4470VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*before 10.0.17763.2029VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*before 10.0.20348.230VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*before 10.0.19042.1083VulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* Versions r2 sp1 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* Versions before 10.0.14393.4470 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* Versions before 10.0.17763.2029 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* Versions before 10.0.20348.230 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:* Versions before 10.0.19042.1083 Vulnerable ·Microsoft

Remediation

Microsoft 17 updates

  • KB5019959
    Security Update
    • Windows 10 Version 20H2 for 32-bit Systems 10.0.19042.2251
    • Windows 10 Version 20H2 for ARM64-based Systems 10.0.19042.2251
    • Windows 10 Version 21H1 for 32-bit Systems 10.0.19043.2251
    • Windows 10 Version 21H1 for ARM64-based Systems 10.0.19043.2251
    • Windows 10 Version 21H1 for x64-based Systems 10.0.19043.2251
    • Windows 10 Version 21H2 for 32-bit Systems 10.0.19044.2251
    • Windows 10 Version 21H2 for ARM64-based Systems 10.0.19044.2251
    • Windows 10 Version 21H2 for x64-based Systems 10.0.19044.2251
    • Windows 10 Version 22H2 for 32-bit Systems 10.0.19045.2251
    • Windows 10 Version 22H2 for ARM64-based Systems 10.0.19045.2251
    • Windows 10 Version 22H2 for x64-based Systems 10.0.19045.2251
  • KB5018427
    Security Update
    • Windows 11 Version 22H2 for ARM64-based Systems 10.0.22621.674
    • Windows 11 Version 22H2 for x64-based Systems 10.0.22621.674
  • KB5008212
    Security Update
    • Windows 10 Version 21H2 for 32-bit Systems 10.0.19044.1415
    • Windows 10 Version 21H2 for ARM64-based Systems 10.0.19044.1415
    • Windows 10 Version 21H2 for x64-based Systems 10.0.19044.1415
Show 14 more Microsoft updates
  • KB5007215
    Security Update
    • Microsoft Edge (Chromium-based) in IE Mode 10.0.22000.318
    • Windows 11 version 21H2 for ARM64-based Systems 10.0.22000.318
    • Windows 11 version 21H2 for x64-based Systems 10.0.22000.318
  • KB5005575
    Security Update
    • Windows Server 2022 10.0.20348.230
    • Windows Server 2022 (Server Core installation) 10.0.20348.230
  • KB5004960
    Security Only
    • Windows Server 2012 6.2.9200.23383
    • Windows Server 2012 (Server Core installation) 6.2.9200.23383
  • KB5004959
    Security Only
    • Windows Server 2008 for 32-bit Systems Service Pack 2 6.0.6003.21138
    • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 6.0.6003.21138
    • Windows Server 2008 for x64-based Systems Service Pack 2 6.0.6003.21138
    • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 6.0.6003.21138
  • KB5004958
    Security Only
    • Windows Server 2012 R2 6.3.9600.20046
    • Windows Server 2012 R2 (Server Core installation) 6.3.9600.20046
  • KB5004956
    Monthly Rollup
    • Windows Server 2012 6.2.9200.23383
    • Windows Server 2012 (Server Core installation) 6.2.9200.23383
  • KB5004955
    Monthly Rollup
    • Windows Server 2008 for 32-bit Systems Service Pack 2 6.0.6003.21138
    • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 6.0.6003.21138
    • Windows Server 2008 for x64-based Systems Service Pack 2 6.0.6003.21138
    • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 6.0.6003.21138
  • KB5004954
    Monthly Rollup
    • Windows RT 8.1 6.3.9600.20046
    • Windows Server 2012 R2 6.3.9600.20046
    • Windows Server 2012 R2 (Server Core installation) 6.3.9600.20046
  • KB5004953
    Monthly Rollup
    • Windows Server 2008 R2 for x64-based Systems Service Pack 1 6.1.7601.25633
    • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 6.1.7601.25633
  • KB5004951
    Security Only
    • Windows Server 2008 R2 for x64-based Systems Service Pack 1 6.1.7601.25633
    • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 6.1.7601.25633
  • KB5004950
    Security Update
    • Windows 10 for 32-bit Systems 10.0.10240.18969
    • Windows 10 for x64-based Systems 10.0.10240.18969
  • KB5004948
    Security Update
    • Windows 10 Version 1607 for 32-bit Systems 10.0.14393.4470
    • Windows 10 Version 1607 for x64-based Systems 10.0.14393.4470
    • Windows Server 2016 10.0.14393.4470
    • Windows Server 2016 (Server Core installation) 10.0.14393.4470
  • KB5004947
    Security Update
    • Windows 10 Version 1809 for 32-bit Systems 10.0.17763.2029
    • Windows 10 Version 1809 for ARM64-based Systems 10.0.17763.2029
    • Windows 10 Version 1809 for x64-based Systems 10.0.17763.2029
    • Windows Server 2019 10.0.17763.2029
    • Windows Server 2019 (Server Core installation) 10.0.17763.2029
  • KB5004945
    Security Update
    • Windows 10 Version 20H2 for 32-bit Systems 10.0.19042.1083
    • Windows 10 Version 20H2 for ARM64-based Systems 10.0.19042.1083
    • Windows Server, version 20H2 (Server Core Installation) 10.0.19042.1083

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Remote Code Execution
Exploited
Yes
Publicly disclosed
Yes
Exploitability
Exploitation Detected

Timeline

  1. 2021-11-03 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2021-34527
  3. 2026-10-03 Alias added: GHSA-75f9-mm5v-2rgm

References

Exploit 3

Patch 2

Advisory 1

  • TI-2017-06077 Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-24062 Windows SMB Client Elevation of Privilege Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2025-24042 Internet Shortcut Files Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2024-32708 Windows Task Scheduler Elevation of Privilege Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2024-29106 Windows MSHTML Platform Spoofing Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2024-19802 Windows MSHTML Platform Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 8.8
See all 1229 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences