Is CVE-2021-36934 (Microsoft Windows SAM Local Privilege Escalation) being exploited in the wild?

Yes. CISA added CVE-2021-36934 to its Known Exploited Vulnerabilities catalogue on 10 February 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.

How CISA’s KEV listing changes the answer to “is it being exploited?”

The practical significance of a KEV entry is that it moves the question from theoretical exposure to confirmed active exploitation. For CVE-2021-36934, that means defenders should treat the issue as in use by attackers, not as a dormant weakness waiting for a patch window. The immediate task is exposure confirmation, because the remediation path depends on whether the system can still be reached and whether the vulnerable conditions are present.

For readers building their triage process, CISA’s Known Exploited Vulnerabilities Catalog is the authoritative trigger for prioritisation, while the CVE Program remains the canonical record for identifying the issue itself. In practice, those two references answer different questions: one tells you what the vulnerability is, the other tells you why it has crossed into urgent response territory.

Why this flaw can lead to SYSTEM-level privilege

This vulnerability matters because it exposes the local Windows Security Account Manager database through a shadow copy condition. If a Volume Shadow Copy of the system drive is available, a local user can read the SAM file and escalate to SYSTEM. That is a high-impact failure mode because it turns ordinary local access into full control of the host, which can then be used for persistence, credential extraction, or additional lateral movement.

For environment owners, the key judgment is whether shadow copies are present and whether local users can reach them. The weakness is not just the file being sensitive, it is the combination of accessible backup material and insufficient protection around the operating system’s account database. The control problem is therefore both exposure management and privilege boundary enforcement.

What to do when patching or full remediation cannot happen immediately

If immediate remediation is delayed, containment should focus on removing the conditions that make the SAM readable and on reducing the value of any local foothold. That usually means restricting access to shadow copies, limiting local interactive access, and reviewing whether the affected host stores credentials or other highly privileged material that would amplify a SYSTEM compromise. The objective is to make exploitation materially harder and to reduce what a local attacker can do if they already have a foothold.

One useful comparison point is Zero-Day and Exploited Vulnerabilities Guide, which helps teams separate urgent exploitation response from ordinary vulnerability backlog work. For cases like this, the decision is not whether the issue is interesting, it is whether the host can be safely left in production before the vulnerable condition is eliminated.

Risk and Threat Considerations

A local privilege escalation flaw becomes much more dangerous when it can be chained after another access path, because the attacker only needs a low-privilege foothold before converting it into SYSTEM. In environments with reusable local admin practices, poor host isolation, or exposed backup artifacts, the attack path can be short and highly reliable.

Failure mechanism: A local user gains read access to the SAM through an available Volume Shadow Copy, then uses the exposed account data to escalate privileges on the same system.

Impact: The attacker can reach SYSTEM-level control, which can enable credential theft, persistence, malware installation, and follow-on access to adjacent systems if the host is trusted elsewhere.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-5 — Account Management	Accounts and local privilege boundaries are central to this local escalation issue.
Recommendation — Restrict local account privilege and remove unnecessary access paths on affected hosts.
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	Credential material exposed through SAM theft makes credential lifecycle control relevant.
	AC-6 — Least Privilege	The flaw escalates from low privilege to SYSTEM, making least-privilege enforcement directly relevant.
	AU-6 — Audit Record Review, Analysis, and Reporting	Post-exploitation review is needed to detect whether the host was abused before remediation.
Recommendation — Rotate and invalidate exposed credentials after confirming local compromise risk. Limit local user rights and administrative exposure to reduce escalation blast radius. Review host logs and security telemetry for signs of local privilege escalation.
MITRE ATT&CK	T1068 — Exploitation for Privilege Escalation	The subject is a privilege-escalation exploit path on Windows hosts.
Recommendation — Map detections to local privilege-escalation behaviour and hunt for SYSTEM gain.
OWASP Non-Human Identity Top 10	NHI-05 — Overprivileged NHI	Privilege escalation increases the importance of limiting overbroad non-human access on exposed systems.
Recommendation — Reduce excessive service and automation privileges on systems that could be escalated locally.

Practitioner Guidance

What to verify: Confirm whether the system has accessible Volume Shadow Copy data, whether local users can enumerate or read it, and whether the host is running with unnecessary local privilege. If you cannot answer those three points quickly, treat the machine as still exposed.

Decision rule: If the host is production-facing or contains privileged credentials, prioritise removal of the exposure and compromise assessment before routine maintenance work. If patching is delayed, assume the system may already be a viable privilege-escalation target and narrow access until the exposure is closed.

Practitioner takeaway: For this CVE, the important question is not whether exploitation is possible in theory, but whether your host still presents the shadow-copy condition that makes local exploitation practical.