How do you patch or mitigate CVE-2021-36955 (Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation)?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

CISA's required action for CVE-2021-36955 is to apply updates per vendor instructions. In practice, find every instance of Microsoft Windows in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

How to confirm exposure before you patch CLFS

Start with scope, not the bulletin headline. Inventory every Windows system that could carry Microsoft’s CLFS driver, then determine whether the host is reachable from untrusted networks or is already isolated behind administrative controls. For a KEV-listed flaw, the question is not whether the vulnerability exists in theory, but whether the vulnerable system is still exposed long enough to be abused.

If the asset is internet-facing or otherwise high-value, treat that as a priority path for update and containment. Use the vendor guidance for the specific update path, then cross-check whether the host belongs to a larger fleet segment that may share the same exposure pattern, such as workstations, jump hosts, or servers that accept administrative logons.

A useful way to frame the exposure check is to pair it with a broader exploited-vulnerability workflow, because CVE response often fails when teams patch the named CVE but miss adjacent systems or unmanaged exceptions. NHIMG’s Zero-Day and Exploited Vulnerabilities Guide is built around that triage pattern: identify what is exposed, decide what can be patched immediately, and reserve mitigations for what cannot be fixed on time.

Patch or mitigate without waiting for a perfect maintenance window

The direct fix is the vendor update. Apply it as soon as your change process allows, and do not postpone it merely because exploitation requires local execution or privilege. On systems that cannot be patched immediately, mitigation should reduce the chance that an attacker can reach or reuse the vulnerable path, which usually means limiting exposure, tightening administrative access, and removing unnecessary internet reachability.

If a system cannot receive the fix and cannot be cleanly segmented, take it out of service rather than leaving it exposed as a temporary exception. That is especially important for endpoints and servers that already have a broad trust footprint, because privilege-escalation flaws become much more valuable when the attacker can already land on the machine through phishing, remote access, or another foothold.

When you need to manage the rollout across many hosts, vulnerability prioritisation matters as much as the patch itself. The Vulnerability Management Guide is the right companion for deciding where to start, how to track exceptions, and how to verify remediation after the update is deployed.

What to look for after remediation

Because this flaw was used in the wild, patching is only half the job. Review endpoint and Windows security logs for signs of earlier exploitation, especially on systems that were exposed before the update landed. Look for suspicious privilege changes, unusual process creation, service installation, or log tampering that could indicate the attacker used the local escalation window before you closed it.

That review should be evidence-driven, not symbolic. If you had any reason to believe the system was exposed before patching, treat the host as a potential compromise candidate until the logs and related telemetry show otherwise. Where the system supported privileged access, also consider whether the attacker could have reached adjacent credentials, sessions, or administrative tooling after escalating locally.

For Windows telemetry, use a log source that gives you the right event coverage rather than ad hoc console review. NHIMG’s Windows Event Log Guide helps map the key logon, service, task, and log-clearing events that matter when you are checking whether exploitation happened before remediation.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	The question is about patching an exploited CVE and verifying remediation.
	CIS-4 — Secure Configuration of Enterprise Assets and Software	Mitigations may require reducing exposure when patching is delayed.
Recommendation — Prioritise and verify remediation for exposed Windows systems. Harden or isolate vulnerable Windows hosts until updates are applied.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The core action is to apply vendor updates for a known exploited flaw.
	AU-6 — Audit Record Review, Analysis, and Reporting	Post-patch review of logs is needed to detect earlier exploitation.
	IR-4 — Incident Handling	Active exploitation requires checking whether the flaw was used before patching.
Recommendation — Apply the vendor fix and track remediation completion. Review audit logs for signs of pre-remediation compromise. Escalate suspected exploitation into incident handling.

Practitioner Guidance

What to prioritise: Patch the most exposed Windows systems first, then move to the assets that can materially expand attacker reach, such as administrative workstations, servers with broad trust, and systems that support sensitive authentication or remote administration.

What to verify: Confirm that the vendor update is actually installed on every in-scope host, and do not treat a scheduled change as remediation until the updated state is visible in inventory or on the endpoint itself. If patching is delayed, verify that the compensating control really removes the exposure rather than merely reducing convenience.

What to measure: Track time to remediate for the fleet segment, the number of hosts still exposed after the first patch cycle, and the number of exceptions that remain open without a documented end date. A shrinking exception list is the clearest signal that the response is being managed rather than deferred.

Practitioner takeaway: For an exploited Windows privilege-escalation CVE, the right decision sequence is exposure reduction, vendor patching, and compromise validation, in that order, because delaying any one of those steps leaves a useful attacker path open.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org