How do you patch or mitigate CVE-2021-1675 (Microsoft Windows Print Spooler Remote Code Execution)?

How to confirm exposure to CVE-2021-1675 before you patch

Start by inventorying every Windows system that exposes the Print Spooler service, including servers that do not serve printers directly. This is a Windows vulnerability response problem first, so the practical question is not just whether the OS is present, but whether the affected service is enabled, reachable, and operational in a way that could be abused.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog to confirm whether your estate still contains exposed instances that need urgent handling. In parallel, keep the CVE Program and NIST National Vulnerability Database as the authoritative references for the record itself, while relying on the vendor for exact product applicability.

If you need a broader response model for exploited issues, NHIMG’s Zero-Day and Exploited Vulnerabilities Guide is useful here because it frames KEV-driven triage, emergency mitigation and post-patch hunting in the way practitioners actually handle actively exploited flaws.

Patch, isolate, or remove the attack path

The primary fix is to apply updates per vendor instructions as soon as you can validate the target systems. Where patching is delayed, reduce exposure rather than hoping the service stays safe by default. That usually means removing internet reachability, limiting network access to trusted management paths, or taking the product out of service if no acceptable mitigation exists.

For this kind of exploited Windows flaw, mitigation is only acceptable when it meaningfully shrinks the reachable attack surface. If the service must remain enabled, prefer compensating controls that directly constrain who can reach it, from where, and under what administrative conditions. A patch plan that leaves the vulnerable service broadly reachable is not a real remediation plan.

NHIMG’s Vulnerability Management Guide fits this step because it covers asset scope, prioritisation, exceptions and verification, which are the practical mechanics behind getting an exploited vulnerability closed across a real estate.

What to check after remediation

Once updates or mitigations are in place, review logs and endpoint telemetry for earlier exploitation attempts, because the flaw was used in the wild. Do not treat successful patching as proof that nothing happened beforehand. The operational question becomes whether the environment was merely exposed or whether an attacker already used that exposure to run code, implant tooling, or pivot further.

Pay special attention to signs of spooler abuse, unexpected process creation, new local accounts, unusual remote management activity, or other changes that suggest an initial foothold. If the affected host had high trust or broad reach, you should also consider whether additional systems received malicious follow-on activity before the patch landed.

Because this specific class of issue often leads to broader host compromise rather than a single isolated event, NHIMG’s Remote Desktop (RDP) Security Guide is a useful adjacent reference when you are checking for post-exploitation movement and session abuse on Windows estates.

Practitioner Guidance

What to prioritise: Treat this as an exploited vulnerability response, not a routine patch ticket. Patch first where you can, but if a system cannot be updated immediately, reduce reachability and service exposure before debating whether the host is “important enough” to leave in place.

What to verify: Confirm which systems still run the Print Spooler, whether those systems are externally reachable, and whether you have evidence of suspicious activity before remediation. The useful evidence is not just patch status, but whether the host shows signs of exploitation, lateral movement or persistence.

Practitioner takeaway: For a KEV-listed, in-the-wild Windows flaw, speed matters, but exposure reduction and post-fix compromise review matter just as much as the patch itself.

Related resources from NHI Mgmt Group

• How do you patch or mitigate CVE-2021-34527 (Microsoft Windows Print Spooler Remote Code Execution)?
• How do you patch or mitigate CVE-2021-33742 (Microsoft Windows MSHTML Platform Remote Code Execution)?
• Is CVE-2021-1675 (Microsoft Windows Print Spooler Remote Code Execution) being exploited in the wild?
• CVE-2021-1675 (Microsoft Windows Print Spooler Remote Code Execution)