Is CVE-2021-36955 (Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2021-36955 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. Any organisation running the affected product should treat remediation as urgent.

How should you treat an exploited Windows CLFS privilege escalation?

CVE-2021-36955 is not a theoretical weakness once CISA has placed it in KEV, because that designation means exploitation has been observed and remediation should be treated as time-sensitive. For defenders, the practical question is not whether exploitation is possible, but whether the affected Windows systems are still exposed, whether patching has already happened, and whether compromise review is needed.

That means response should be driven by exposure status, business criticality, and whether the system can be taken out of service long enough to remediate cleanly. If the vulnerable host cannot be patched immediately, temporary containment and heightened monitoring become part of the response, not an optional extra.

For vulnerability triage and emergency response sequencing, follow the workflow in Zero-Day and Exploited Vulnerabilities Guide and confirm whether your estate still contains the affected Windows build or role.

What does the KEV listing mean for defenders?

CISA KEV is useful because it converts a vulnerability from abstract severity into an operationally validated threat. For a Windows privilege-escalation flaw, that usually means attackers can use local access, weak initial footholds, or a chained exploit path to move from a standard user context into higher privilege on the same host.

This is why KEV status matters even when the vulnerability is old or appears narrow in scope. Once active exploitation is known, the defender should assume opportunistic scanning and follow-on abuse are already part of the threat environment, especially on internet-facing, poorly monitored, or long-lived Windows systems.

Use CISA Known Exploited Vulnerabilities Catalog to verify the record and NIST National Vulnerability Database to cross-check the CVE entry and associated technical metadata.

What should you do if patching has to wait?

If remediation cannot happen immediately, the goal is to reduce the chance that the flaw can be used to turn one foothold into elevated control. That means limiting which users can log on interactively, reviewing local admin membership, restricting remote access paths, and prioritising systems that host sensitive data, administrative tooling, or software deployment services.

Because this is a privilege-escalation issue, your response should also include evidence gathering for earlier compromise. Look for suspicious account changes, unusual service creation, abnormal scheduled tasks, new privileged logons, and signs of lateral movement from the affected host. If a machine was already hostile before the patch, fixing the vulnerability alone does not remove the risk.

Windows event logging is especially valuable here, since escalation attempts often leave authentication, privilege, and service-creation traces. Pair the review with a targeted compromise assessment rather than treating the patch as the end of the incident review.

For event visibility and investigative follow-up, use Windows Event Log Guide and map suspicious activity to MITRE ATT&CK Enterprise Matrix when you need a defender-friendly view of privilege escalation and post-exploitation behavior.

Risk and Threat Considerations

Privilege-escalation bugs are attractive because they shorten the path from access to control. In a Windows environment, that can convert a low-value foothold into administrative execution, credential exposure, or a staging point for ransomware and broader internal movement.

Failure mechanism: An attacker with any usable code execution or local foothold leverages the CLFS driver flaw to raise privilege on the host, then uses that elevated context to disable defenses, dump credentials, or pivot further into the environment.

Impact: The immediate impact is host compromise at a higher trust level, but the practical business impact can extend to domain movement, defense evasion, and deployment of ransomware or other payloads from an already trusted Windows system.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	CVE exploitation makes timely remediation and verification essential.
	AU-6 — Audit Record Review, Analysis, and Reporting	Privilege escalation needs log review to detect abuse and earlier compromise.
Recommendation — Prioritise flaw remediation and confirm vulnerable Windows hosts are actually patched. Review Windows audit records for privilege changes, service creation and suspicious logons.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation requires rapid asset scope, prioritisation and remediation tracking.
Recommendation — Track exposed Windows systems and accelerate remediation based on exploitability.
MITRE ATT&CK	T1068 — Exploitation for Privilege Escalation	The CVE is a Windows privilege-escalation path used after initial access.
Recommendation — Hunt for exploitation-for-privilege-escalation behavior on affected hosts.
NIST CSF 2.0	RS.MA-01 — Mitigation is executed	Active exploitation makes rapid containment and remediation an incident-response need.
Recommendation — Execute mitigation quickly and track exposed hosts to closure.

Practitioner Guidance

What to prioritise: Treat every exposed instance as a remediation candidate, but prioritise systems with privileged users, remote management exposure, sensitive data, or shared operational roles first. Those systems create the largest blast radius if escalation is successful.

What to verify: Confirm that the vulnerable hosts are actually patched, that the patch was applied to the live system and not just a template or image, and that no suspicious privilege changes occurred before remediation. If the system cannot be verified, assume it still needs review.

Practitioner takeaway: For a KEV-listed privilege-escalation flaw, the real decision is not whether to patch, but whether you can prove exposure is closed and no pre-patch compromise remains.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org