Is CVE-2021-36942 (Microsoft Windows Local Security Authority (LSA) Spoofing) being exploited in the wild?

What does “exploited in the wild” mean for CVE-2021-36942?

For this CVE, “exploited in the wild” means the issue moved beyond a theoretical weakness or lab proof and was observed with real attacker activity. In practice, that changes the response priority immediately: the question is no longer whether exploitation is possible, but whether your environment could still be exposed and whether compromise may already have occurred.

Because CISA listed it in the KEV catalog and tied it to ransomware use, the operational meaning is straightforward: treat it as an active threat condition, not a routine vulnerability backlog item. The right posture is urgent exposure checking, rapid mitigation, and follow-up validation rather than waiting for a more convenient patch window.

For a Windows LSA spoofing issue, the security concern is not only the flaw itself but the trust relationship it abuses. If an attacker can coerce authentication behavior through LSARPC, the result can extend into domain credentials, machine trust, and downstream access paths that support lateral movement.

What should defenders check first on Windows and domain controller estates?

The first task is to confirm whether the vulnerable Windows systems are present in the estate and whether the domain controller role or related trust relationships make the exposure materially important. That includes asset inventory, patch state, and any place where authentication flows from a system that could be coerced into talking to an untrusted endpoint.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog for authoritative remediation details, and verify whether the affected systems are still in service, internet-reachable, or part of sensitive administrative pathways. The question is not only whether the CVE exists in your environment, but whether it sits on a high-value path where spoofed authentication could matter.

If you manage Windows endpoints broadly, the practical follow-up is to confirm whether hardening measures that reduce LSA abuse are already present. Guidance on Windows endpoint hardening helps frame the defensive context, while endpoint hardening verification is useful when you need evidence that baseline controls were actually deployed.

How should teams respond when patching has to wait?

If you cannot remediate immediately, reduce the blast radius around the trust path rather than treating delay as neutral. Limit where domain controllers and privileged Windows systems can initiate outbound authentication, isolate high-value administrative segments, and watch for abnormal coercion or authentication relay patterns.

That matters because active exploitation can turn a single spoofing weakness into credential exposure, relay, or privilege escalation opportunities. A good response plan therefore combines temporary containment with detection and compromise assessment, instead of assuming that “delayed patching” is safe as long as the system is monitored.

For detection and validation, Windows event logging is the most practical starting point for confirming unusual logons, account changes, and related follow-on activity. If the environment has already shown credential exposure elsewhere, the same reasoning used in credential leak and lateral movement cases applies: exposed Windows trust material often warrants more than a patch-only response.

Risk and Threat Considerations

Because this CVE is already in CISA’s exploited list and linked to ransomware, the main risk is not abstract vulnerability exposure but real-world misuse of Windows trust relationships. If attackers can trigger authentication behavior from a domain controller or other sensitive host, they may be able to pivot into credential harvesting, relay, or lateral movement.

Failure mechanism: An unauthenticated attacker abuses the spoofing condition on LSARPC to coerce authentication against another server, which can expose NTLM-based trust paths and enable downstream abuse of domain trust.

Impact: Successful exploitation can support unauthorized access, privileged movement, and ransomware staging, especially where Windows identity paths are shared across sensitive systems or administrative segments.

Practitioner Guidance

What to prioritise: Treat KEV-listed exploitation as a triage override. If the vulnerable Windows systems sit on a domain trust path or support privileged administration, prioritize them ahead of lower-value endpoints and verify whether compensating controls are actually present.

What to verify: Confirm not just patch status, but whether the environment has signs of pre-compromise. Review authentication anomalies, new service activity, unusual account usage, and any evidence that trust relationships were exercised in ways that do not match normal operations.

Decision rule: If patching cannot happen immediately, reduce exposure first, then hunt for compromise, then rotate anything the flaw could have exposed. For domain-facing Windows systems, that often means treating credentials and sessions as potentially at risk when there is credible evidence of exploitation.

Practitioner takeaway: An exploited-in-the-wild Windows LSA spoofing CVE should be handled as a trust-path incident, not just a software defect, because the security question is whether authentication abuse has already turned into access.

Related resources from NHI Mgmt Group

• Guide: Zero-Day and Exploited Vulnerabilities Guide
• CVE-2021-36942 (Microsoft Windows Local Security Authority (LSA) Spoofing)
• Is CVE-2022-26925 (Microsoft Windows LSA Spoofing) being exploited in the wild?
• Is CVE-2021-36934 (Microsoft Windows SAM Local Privilege Escalation) being exploited in the wild?
• Is CVE-2021-43890 (Microsoft Windows AppX Installer Spoofing) being exploited in the wild?