How do you patch or mitigate CVE-2021-36934 (Microsoft Windows SAM Local Privilege Escalation)?

CISA’s required action for CVE-2021-36934 is to apply updates per vendor instructions. In practice, find every instance of Microsoft Windows in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

Where to confirm exposure before you patch

Start with inventory, because the right response depends on finding every affected Windows instance, not just the servers you already monitor closely. Treat this as a broad estate check across endpoints, servers, and any remote or seldom-used systems that may have missed standard patch cycles. The vendor advisory and the CISA Known Exploited Vulnerabilities Catalog are the authoritative places to confirm current remediation guidance.

Use this phase to identify where the flaw is exposed to ordinary user access, where local interactive access is already too open, and where change windows are tight enough that mitigation may have to precede full remediation. That matters because KEV-listed issues are not just theoretical weaknesses, they are actively exploited conditions that deserve immediate attention.

How to remediate when a vendor fix is available

The preferred action is to apply the vendor security update or the documented mitigation exactly as instructed, then verify that the affected system is running the expected patched state. For a vulnerability like this, patching is only complete when the update is installed, the relevant system is rebooted if required, and the asset is rechecked so the exposure does not persist in a partially remediated state.

If you manage patching centrally, make sure the rollout includes systems that are easy to forget, such as admin workstations, jump hosts, and isolated business units. A good patch job here is less about speed alone and more about completeness, because a single unpatched Windows host can remain an escalation target inside an otherwise well-maintained environment.

When you cannot patch immediately

If you cannot apply the fix right away, reduce the reachable attack surface until you can. That usually means removing unnecessary internet exposure, tightening network reachability, and, where appropriate, taking the product out of service rather than leaving a known exploitable system available for routine use. The goal is to make local privilege escalation materially harder to reach and less useful if an attacker already has a foothold.

Mitigation is not a substitute for remediation, but it is the right short-term decision when downtime, compatibility, or maintenance constraints delay patching. In those cases, document the exception, put an expiry on it, and track it as an active exposure rather than a normal risk acceptance.

Risk and Threat Considerations

This vulnerability matters because local privilege escalation often converts a low-privilege foothold into full host control, which can then support credential theft, persistence, and lateral movement. The danger is greatest when untrusted users, remote access paths, or exposed management surfaces make it easy for an attacker to land first and escalate second.

Failure mechanism: The flaw lets a local actor elevate privileges on a Windows system, so a compromise that begins with limited access can quickly become administrative control over the host.

Impact: Once elevated, an attacker may be able to disable defenses, access sensitive files, harvest credentials, or use the system as a staging point for broader environment compromise.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	This is a patch-and-mitigation question for an exploited Windows CVE.
Recommendation — Prioritise, remediate, and verify exploited vulnerabilities across the Windows estate.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The question asks how to apply vendor fixes and track remediation of a known flaw.
	RA-5 — Vulnerability Monitoring and Scanning	Confirming exposure and verifying closure requires scanning and exposure validation.
Recommendation — Track, test, and install vendor flaw remediation on affected Windows systems. Scan for affected hosts and validate that remediation removed the vulnerability.
NIST CSF 2.0	PR.IP-12 — Vulnerability Management	The response centers on identifying, patching, and tracking an actively exploited vulnerability.
	DE.CM-08 — Vulnerability Scans are Performed	Post-patch verification depends on scanning and confirming the flaw is no longer present.
Recommendation — Operate a vulnerability management process that prioritises and closes exploited Windows flaws. Use vulnerability scanning to confirm the CVE is no longer exposed after remediation.

Practitioner Guidance

What to verify: Confirm not only that the update was deployed, but that the vulnerable asset was actually covered by your patch scope. Validate the remediation on representative systems and check for devices that may have missed normal management channels, because local privilege escalation flaws are often most dangerous on neglected hosts.

What to measure: Track the number of exposed Windows instances, the time to remediate KEV-listed issues, and the count of exceptions still awaiting closure. Those metrics tell you whether this is being handled as an emergency exposure or just another patch ticket.

Practitioner takeaway: For KEV-listed privilege escalation flaws, the decisive control is fast, verified exposure removal, patching alone is not enough if unmanaged Windows hosts remain reachable or unreviewed.