Read the docs
TI-2021-14014 Aliases CVE-2021-35052GHSA-4cg4-9g5h-4f6m

Improper privilege management in Kaspersky Password Manager for Windows

Priority LOW 34CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-269.

Summary

A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High.

Why it matters now

EPSS 0.00339 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Kaspersky Password Manager for WindowsKPM for Windows prior to 9.0.2 Patch R—No fix listedCNA
  • Kaspersky Password Manager for Windows Vendor— Affected KPM for Windows prior to 9.0.2 Patch R Fixed in — No fix listed CNA

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:a:kaspersky:password_manager:*:*:*:*:*:windows:*:*up to 9.0.1VulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:-:*:*:*:windows:*:*9.0.2VulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_a:*:*:*:windows:*:*9.0.2 patch_aVulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_b:*:*:*:windows:*:*9.0.2 patch_bVulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_c:*:*:*:windows:*:*9.0.2 patch_cVulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_d:*:*:*:windows:*:*9.0.2 patch_dVulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_e:*:*:*:windows:*:*9.0.2 patch_eVulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_f:*:*:*:windows:*:*9.0.2 patch_fVulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_g:*:*:*:windows:*:*9.0.2 patch_gVulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_h:*:*:*:windows:*:*9.0.2 patch_hVulnerableKaspersky
  • cpe:2.3:a:kaspersky:password_manager:*:*:*:*:*:windows:*:* Versions up to 9.0.1 Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:-:*:*:*:windows:*:* Versions 9.0.2 Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_a:*:*:*:windows:*:* Versions 9.0.2 patch_a Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_b:*:*:*:windows:*:* Versions 9.0.2 patch_b Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_c:*:*:*:windows:*:* Versions 9.0.2 patch_c Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_d:*:*:*:windows:*:* Versions 9.0.2 patch_d Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_e:*:*:*:windows:*:* Versions 9.0.2 patch_e Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_f:*:*:*:windows:*:* Versions 9.0.2 patch_f Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_g:*:*:*:windows:*:* Versions 9.0.2 patch_g Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_h:*:*:*:windows:*:* Versions 9.0.2 patch_h Vulnerable ·Kaspersky
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_i:*:*:*:windows:*:*9.0.2 patch_iVulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_j:*:*:*:windows:*:*9.0.2 patch_jVulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_k:*:*:*:windows:*:*9.0.2 patch_kVulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_l:*:*:*:windows:*:*9.0.2 patch_lVulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_m:*:*:*:windows:*:*9.0.2 patch_mVulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_n:*:*:*:windows:*:*9.0.2 patch_nVulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_o:*:*:*:windows:*:*9.0.2 patch_oVulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_p:*:*:*:windows:*:*9.0.2 patch_pVulnerableKaspersky
cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_q:*:*:*:windows:*:*9.0.2 patch_qVulnerableKaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_i:*:*:*:windows:*:* Versions 9.0.2 patch_i Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_j:*:*:*:windows:*:* Versions 9.0.2 patch_j Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_k:*:*:*:windows:*:* Versions 9.0.2 patch_k Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_l:*:*:*:windows:*:* Versions 9.0.2 patch_l Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_m:*:*:*:windows:*:* Versions 9.0.2 patch_m Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_n:*:*:*:windows:*:* Versions 9.0.2 patch_n Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_o:*:*:*:windows:*:* Versions 9.0.2 patch_o Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_p:*:*:*:windows:*:* Versions 9.0.2 patch_p Vulnerable ·Kaspersky
  • cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_q:*:*:*:windows:*:* Versions 9.0.2 patch_q Vulnerable ·Kaspersky

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-35052
  2. 2026-10-03 Alias added: GHSA-4cg4-9g5h-4f6m

References

Advisory 2

  • TI-2018-04637 Untrusted search path in Kaspersky Password Manager CVSS 3.0HIGH 7.8
  • TI-2020-16441 Password generator feature in Kaspersky Password Manager was not completely… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences