Is CVE-2021-1675 (Microsoft Windows Print Spooler Remote Code Execution) being exploited in the wild?

Yes. CISA added CVE-2021-1675 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution. Any organisation running the affected product should treat remediation as urgent.

What CISA’s KEV listing means for exploitation status

CISA’s Known Exploited Vulnerabilities catalogue is the key signal here: if a CVE is listed there, the operational assumption should be that exploitation is already happening or has happened recently enough to justify urgent response. For CVE-2021-1675, that means the question is no longer academic, it is a live exposure management problem.

For Windows Print Spooler flaws, “being exploited in the wild” changes the response from ordinary patch scheduling to immediate triage, because the issue can be used as a remote code execution path. Treat the affected service and every reachable Windows host as a potential entry point until exposure is confirmed and reduced.

How to confirm whether your environment is exposed

First determine where the Print Spooler is enabled, where it is reachable, and which systems actually need it. In practice, the fastest value comes from inventorying servers and endpoints, identifying systems that expose the service unnecessarily, and checking whether compensating restrictions already block remote abuse.

Because the vulnerability is tied to a core Windows service, the most important question is not only whether a machine is patched, but whether the service is present on a system that should never have needed it. Any environment that still depends on legacy printing workflows needs a separate exposure review, especially where broad internal access is allowed.

For authoritative version and remediation details, use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog rather than relying on secondary summaries.

What to do when remediation must wait

If patching cannot happen immediately, reduce the attack surface by disabling the Print Spooler wherever printing is not required, restricting it to the smallest possible set of hosts, and removing unnecessary remote access paths to systems that keep the service enabled. Temporary mitigation is about shrinking opportunity, not assuming safety.

Where the service must remain active, watch for unusual spooler-related activity, suspicious child processes, and unexpected administrative actions on endpoints and servers that should not be generating print traffic. That monitoring is especially important on systems that sit close to privileged credentials, file shares, or management tooling.

The NIST Cybersecurity Framework 2.0 is useful here because it frames this as an identify, protect, detect, respond, and recover problem rather than a one-time patch event.

Risk and Threat Considerations

Actively exploited Print Spooler flaws matter because a single vulnerable host can become an initial foothold for remote code execution, then privilege escalation, lateral movement, and ransomware staging. If the service is broadly enabled across the estate, the same weakness can repeat at scale instead of remaining an isolated patching issue.

Failure mechanism: An attacker reaches a reachable Windows Print Spooler instance, abuses the vulnerability to execute code remotely, and uses that execution context to pivot, persist, or stage follow-on activity before defenders notice.

Impact: The likely outcome is unauthorized execution on Windows systems, with downstream exposure ranging from local compromise to enterprise-wide intrusion, especially where the affected host can reach sensitive network segments or administrative services.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation calls for rapid vuln inventory and remediation prioritization.
Recommendation — Prioritise and remediate KEV-listed hosts first, then verify coverage with repeatable scanning.
NIST CSF 2.0	ID.RA-01 — Asset vulnerabilities are identified and documented	You need asset visibility to know which Windows systems expose Print Spooler.
	PR.PS-06 — Integrity of hardware, software, firmware, and information is protected	Patched and hardened endpoint software integrity is central to reducing RCE risk.
	DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events	Monitoring is needed to spot exploitation or post-exploitation activity on Windows hosts.
Recommendation — Identify every exposed Windows asset and document where the spooler is enabled. Apply the fix and harden affected Windows systems so remote execution paths are removed. Monitor spooler-related activity and investigate anomalous execution on exposed systems.

Practitioner Guidance

What to prioritise: Prioritise systems where Print Spooler is both enabled and reachable from user or administrative networks, then move to any host that can reach high-value credentials or management planes. Those systems carry the highest blast radius if exploitation succeeds.

What to verify: Confirm that patching has actually landed on every in-scope Windows asset, that the service is disabled where unnecessary, and that any exception is time-bound and documented. A patch alone is not enough if the service remains exposed in a way the business does not need.

What to measure: Track the number of enabled spooler instances, the time to remove or patch them after KEV publication, and whether any unplanned spooler activity appears in logging. Those metrics tell you whether the environment is shrinking risk or merely deferring it.

Practitioner takeaway: When a Windows vulnerability is in CISA KEV and tied to ransomware use, the right operating assumption is active exploitation, so exposure reduction and verification matter as much as the patch itself.