Is CVE-2021-33739 (Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation) being exploited in the wild?

Yes. CISA added CVE-2021-33739 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. Any organisation running the affected product should treat remediation as urgent.

What the exploitation status means for defenders

CISA’s KEV listing means this is not a theoretical vulnerability, it is one with credible evidence of active abuse. For defenders, the practical question is not whether exploitation is possible, but whether the affected DWM Core Library is present anywhere in the environment and whether exposed hosts have already been targeted.

When a Windows component is on the KEV catalogue, triage should move ahead of normal vulnerability queues. A privilege-escalation flaw can be used after an initial foothold to turn limited access into local administrative control, so exposure assessment should include workstations, servers, jump hosts, and any asset where local privilege gain could materially widen impact.

That prioritisation is consistent with the guidance in the Zero-Day and Exploited Vulnerabilities Guide, which treats KEV, exploitability, and time-to-remediate as the main signals for emergency handling. Use the vendor advisory and the CISA KEV catalogue for the exact remediation path and version details rather than relying on secondary summaries.

How to confirm exposure and decide what to do next

Confirm whether any Windows systems in scope run the affected Microsoft Desktop Window Manager Core Library component and whether they are internet-facing, externally reachable through remote administration, or otherwise accessible to an attacker with a first foothold. Inventory matters here because privilege-escalation flaws are often most dangerous on endpoints that already contain sensitive sessions, credentials, or privileged tooling.

If patching is available, treat it as an urgent remediation item and accelerate it ahead of routine maintenance windows. If you cannot patch immediately, reduce exposure by tightening local administrative access, limiting interactive use on affected systems, and watching for suspicious child processes, privilege changes, or unexpected system-level activity on vulnerable hosts.

The difference between urgent and merely important is often the blast radius. The same flaw is far more consequential on a workstation used by administrators or on a server that brokers access to other systems, because local privilege escalation can become the bridge to credential theft, lateral movement, and broader compromise.

For that reason, the CISA Known Exploited Vulnerabilities Catalog should be used as the operational trigger, while the NIST National Vulnerability Database and the CVE Program remain the reference points for record detail, naming, and downstream tracking.

What to look for if you suspect compromise

If exploitation may already have occurred, focus on signs of privilege gain rather than the vulnerability itself. Review for unexpected elevation to administrator context, new services, scheduled tasks, unusual process chains, tampering with security tooling, and access to data or credentials that a normal user account should not reach.

Because this is an escalation issue, earlier compromise can be subtle. The initial attacker activity may look like ordinary user execution, but the meaningful change is the moment the attacker can act with higher privilege, disable controls, or pivot into other systems. That is why checking only for crash artefacts or obvious exploit traces is not enough.

Where the host held privileged sessions, tokens, or cached credentials, consider whether those secrets were exposed during or after escalation. The right follow-on action is often not just system repair, but also targeted credential review for accounts that were active on the affected machine at the time of suspicion.

Risk and Threat Considerations

This flaw matters because active exploitation turns a single host weakness into an access amplifier. An attacker who can elevate privileges on a user system may be able to disable defensive tooling, access protected data, or move toward adjacent systems that trust the compromised host.

Failure mechanism: The vulnerability allows local privilege escalation, so a lower-privileged foothold can be converted into elevated control on the same machine before defenders notice the initial access.

Impact: That elevated control can expand the attacker’s options for persistence, credential access, and lateral movement, and it can turn an otherwise contained intrusion into a broader incident.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation requires rapid identification and remediation of affected hosts.
Recommendation — Prioritise, track, and remediate the affected systems before routine vulnerability queues.
MITRE ATT&CK	T1068 — Exploitation for Privilege Escalation	The vulnerability is a privilege-escalation path attackers can use after initial access.
Recommendation — Hunt for escalation activity and correlate it with suspicious post-exploit host behaviour.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	A known exploited flaw requires accelerated remediation and verification of affected assets.
Recommendation — Accelerate remediation for affected systems and verify closure on the vulnerable component.

Practitioner Guidance

What to prioritise: Start with assets where local privilege gain would matter most, such as administrator workstations, jump hosts, and systems that store or broker sensitive sessions. In this situation, asset criticality should outrank simple patch ordering.

What to verify: Confirm the exact affected software presence on live systems, then validate whether any host already shows privilege-change artefacts or suspicious process activity. If patching was delayed, verify compensating controls, not just installation status.

Practitioner takeaway: A KEV-listed privilege-escalation issue should be handled as an exposure and compromise question, not only as a patching task, because the real risk is what an attacker can do after gaining local elevation.