CriticalCVE-2021-33771

Windows Kernel Elevation of Privilege Vulnerability (CVE-2021-33771)

Published 14.07.2021Last modified 10.08.2026In CISA KEV since 03.11.2021Sources: CVE.org

Actively exploited

What is affected, what to do

Windows Kernel Elevation of Privilege Vulnerability

The vulnerability is being actively exploited; treat it as a priority. Update Microsoft Windows 10 Version 1507 to version 10.0.10240.19003, Microsoft Windows 10 Version 1607 to version 10.0.14393.4530, Microsoft Windows 10 Version 1809 to version 10.0.17763.2061. Immediate actions, mitigation and detection rules are in the runbook below.

Affected: Microsoft Windows 10 Version 1507 lt 10.0.10240.0..10.0.10240.19003
Microsoft Windows 10 Version 1607 lt 10.0.14393.0..10.0.14393.4530
Microsoft Windows 10 Version 1809 lt 10.0.17763.0..10.0.17763.2061
Microsoft Windows 10 Version 1909 lt 10.0.0..10.0.18363.1679
Microsoft Windows 10 Version 2004 lt 10.0.0..10.0.19041.1110
Microsoft Windows 10 Version 20H2 lt 10.0.0..10.0.19042.1110
Microsoft Windows 10 Version 21H1 lt 10.0.0..10.0.19043.1110
Microsoft Windows 8.1 lt 6.3.0..6.3.9600.20069
Microsoft Windows Server 2012 R2 lt 6.3.9600.0..6.3.9600.20069
Microsoft Windows Server 2012 R2 (Server Core installation) lt 6.3.9600.0..6.3.9600.20069
Microsoft Windows Server 2016 lt 10.0.14393.0..10.0.14393.4530
Microsoft Windows Server 2016 (Server Core installation) lt 10.0.14393.0..10.0.14393.4530
Microsoft Windows Server 2019 lt 10.0.17763.0..10.0.17763.2061
Microsoft Windows Server 2019 (Server Core installation) lt 10.0.17763.0..10.0.17763.2061
Microsoft Windows Server version 2004 lt 10.0.0..10.0.19041.1110
Microsoft Windows Server version 20H2 lt 10.0.0..10.0.19042.1110
Fixed in: Microsoft Windows 10 Version 1507 10.0.10240.19003
Microsoft Windows 10 Version 1607 10.0.14393.4530
Microsoft Windows 10 Version 1809 10.0.17763.2061
Microsoft Windows 10 Version 1909 10.0.18363.1679
Microsoft Windows 10 Version 2004 10.0.19041.1110
Microsoft Windows 10 Version 20H2 10.0.19042.1110
Microsoft Windows 10 Version 21H1 10.0.19043.1110
Microsoft Windows 8.1 6.3.9600.20069
Microsoft Windows Server 2012 R2 6.3.9600.20069
Microsoft Windows Server 2012 R2 (Server Core installation) 6.3.9600.20069
Microsoft Windows Server 2016 10.0.14393.4530
Microsoft Windows Server 2016 (Server Core installation) 10.0.14393.4530
Microsoft Windows Server 2019 10.0.17763.2061
Microsoft Windows Server 2019 (Server Core installation) 10.0.17763.2061
Microsoft Windows Server version 2004 10.0.19041.1110
Microsoft Windows Server version 20H2 10.0.19042.1110

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

7.8

Priority

XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

Source: NVD, CVSS v3

7.8

CVSS v3

Severity High on the scale from 0 to 10.

Source: CVE.org

10.2 %

EPSS score

Elevated — model estimates 10-50% exploitation likelihood.

Source: FIRST EPSS, percentile 95.6

Show all metrics

Severity: Critical
Priority (0–325) The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first? Read in glossary: 212.18 Methodology
Exploit maturity An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack. Read in glossary: actively exploited
XIEM Effective CVSS XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command. Read in glossary: 7.8 Methodology
CVSS v3 CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions. Read in glossary: 7.8
EPSS score The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“. Read in glossary: 10.2 %; Elevated — model estimates 10-50% exploitation likelihood.
EPSS percentile The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking. Read in glossary: 95.6; Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching. Read in glossary: Actively exploited
Published: 14.07.2021
In CISA KEV since The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching. Read in glossary: 03.11.2021
CISA assessment (SSVC): Exploitation: active · not automatable · Technical impact: total; Source: CISA Vulnrichment, as of 6 February 2024

Response and mitigation

Why act now?

Prioritisation rationale

This is a local kernel privilege escalation with full confidentiality, integrity and availability impact. It requires only low-privileged code execution and no user interaction. It was used as a zero-day inside exploit chains, where a browser or document foothold was escalated to SYSTEM to install espionage implants. Exploitation likelihood is high relative to the broader CVE population, and CISA does not flag ransomware use. Because the fix has been available for a long time, any host still vulnerable mainly signals a patch-management gap or an unsupported OS. Prioritise terminal servers, jump hosts and high-exposure users (executives, developers, OT engineering workstations), and handle general clients in a prompt but regular patch cycle.

01
Runbook step 1
Immediate response (0-24 h)
- Verify patch level: Check every Windows client and server against the fixed builds. Minimum versions are 10.0.10240.19003 (1507), 10.0.14393.4530 (1607), 10.0.17763.2061 (1809), 10.0.18363.1679 (1909), 10.0.19041.1110 (2004), 10.0.19042.1110 (20H2), 10.0.19043.1110 (21H1) and 6.3.9600.20069 (Windows 8.1). Pull build numbers via [System.Environment]::OSVersion.Version or from Intune/SCCM/MDE inventory.
- Deploy the cumulative security update: A Microsoft patch is available. Look up the KB number per build in the MSRC advisory for CVE-2021-33771. Any later cumulative update also contains the fix, so go straight to the current monthly rollup.
- Include server equivalents: Server builds sharing the same codebase (14393 = Server 2016, 17763 = Server 2019) should be confirmed in the MSRC advisory and treated with equal priority. This applies especially to RDS/Citrix hosts, terminal servers and jump hosts with many interactive users.
- Contain unsupported systems: Windows 8.1 and Windows 10 1507, 1909, 2004, 20H2 and 21H1 no longer receive updates. Move these systems into a restricted segment and escalate the migration plan.
- Hunt on long-unpatched hosts: Where systems stayed vulnerable for an extended period and had interactive use, hunt for privilege-escalation artefacts (see Detection rules). On any hit, reset privileged credentials that may have been cached on the host.
02
Runbook step 2
Mitigation layers
- Network: There is no network attack vector, because exploitation requires local code execution. Network controls therefore limit blast radius only: block client-to-client SMB 445, RDP 3389 and WinRM 5985/5986 via Windows Firewall GPO.
- Application control: Run WDAC or AppLocker in enforce mode. Block execution from %TEMP%, %APPDATA%, %LOCALAPPDATA% and Downloads. Kernel exploits are typically dropped as a second-stage binary or run in memory by an initial-access implant.
- Reduce initial access: Enable Defender ASR rules, notably "Block executable content from email client and webmail", "Block Office applications from creating child processes" and "Block process creations originating from PSExec and WMI commands". Keep browsers and Office current, since kernel EoP bugs are commonly chained behind browser or document exploits.
- Identity and least privilege: Enforce admin tiering so domain or Tier 0 admins never log on to workstations (GPO "Deny log on locally"). Use Windows LAPS for local admin accounts. Enable Credential Guard and LSA protection (RunAsPPL) so that SYSTEM access does not immediately yield domain credentials.
- Endpoint hardening: Enforce EDR tamper protection. Enable the Microsoft Vulnerable Driver Blocklist and HVCI/Memory Integrity where hardware allows. Both make post-escalation kernel persistence harder.
03
Runbook step 3
Detection rules
- Sysmon EID 1 / Security 4688, integrity jump: Process running with IntegrityLevel=System or User=NT AUTHORITY\SYSTEM whose parent runs as a standard medium-integrity user and is not a legitimate service broker. Sigma shape: ParentUser != SYSTEM AND User == SYSTEM AND ParentImage NOT IN (services.exe, svchost.exe, msiexec.exe, wininit.exe).
- MDE/KQL, SYSTEM shell from user context: DeviceProcessEvents | where AccountSid == "S-1-5-18" and InitiatingProcessAccountSid != "S-1-5-18" and FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe").
- Failed exploit attempts: Unreliable kernel exploits often crash the box. Watch System Event ID 1001 (BugCheck) and 41 (Kernel-Power) plus new MEMORY.DMP or minidumps. Several bugchecks on one workstation in a short window, followed by new SYSTEM-level process activity, is a strong signal.
- Post-escalation activity: Security 4672 (special privileges) for unexpected accounts. LSASS access (Sysmon EID 10, TargetImage ending in lsass.exe, GrantedAccess 0x1010/0x1FFFFF). New services (System 7045, Security 4697). Loading of unsigned or rare drivers (Sysmon EID 6).
- Vulnerability telemetry: Schedule DeviceTvmSoftwareVulnerabilities | where CveId == "CVE-2021-33771" daily and auto-ticket every remaining vulnerable asset.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2 NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management. Read in glossary: Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates. Read in glossary: Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001 ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security. Read in glossary: Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Windows Kernel Elevation of Privilege Vulnerability

Source: CISA KEV Catalog, NVD (NIST), cvelistv5, CVE.org (MITRE)

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

Affected products
		Affected versions	Fixed in
Microsoft	Windows 10 Version 1507	`10.0.10240.0 – < 10.0.10240.19003`	`10.0.10240.19003`
Microsoft	Windows 10 Version 1607	`10.0.14393.0 – < 10.0.14393.4530`	`10.0.14393.4530`
Microsoft	Windows 10 Version 1809	`10.0.17763.0 – < 10.0.17763.2061`	`10.0.17763.2061`
Microsoft	Windows 10 Version 1909	`10.0.0 – < 10.0.18363.1679`	`10.0.18363.1679`
Microsoft	Windows 10 Version 2004	`10.0.0 – < 10.0.19041.1110`	`10.0.19041.1110`
Microsoft	Windows 10 Version 20H2	`10.0.0 – < 10.0.19042.1110`	`10.0.19042.1110`
Microsoft	Windows 10 Version 21H1	`10.0.0 – < 10.0.19043.1110`	`10.0.19043.1110`
Microsoft	Windows 8.1	`6.3.0 – < 6.3.9600.20069`	`6.3.9600.20069`
Microsoft	Windows Server 2012 R2	`6.3.9600.0 – < 6.3.9600.20069`	`6.3.9600.20069`
Microsoft	Windows Server 2012 R2 (Server Core installation)	`6.3.9600.0 – < 6.3.9600.20069`	`6.3.9600.20069`
Microsoft	Windows Server 2016	`10.0.14393.0 – < 10.0.14393.4530`	`10.0.14393.4530`
Microsoft	Windows Server 2016 (Server Core installation)	`10.0.14393.0 – < 10.0.14393.4530`	`10.0.14393.4530`
Microsoft	Windows Server 2019	`10.0.17763.0 – < 10.0.17763.2061`	`10.0.17763.2061`
Microsoft	Windows Server 2019 (Server Core installation)	`10.0.17763.0 – < 10.0.17763.2061`	`10.0.17763.2061`
Microsoft	Windows Server version 2004	`10.0.0 – < 10.0.19041.1110`	`10.0.19041.1110`
Microsoft	Windows Server version 20H2	`10.0.0 – < 10.0.19042.1110`	`10.0.19042.1110`

Vendors and products

Affected operating systems

Affected operating systems

Windows	microsoft	windows_10_1507	`10.0.10240.19003`
Windows	microsoft	windows_10_1507	—
Windows	microsoft	windows_10_1607	`10.0.14393.4530`
Windows	microsoft	windows_10_1607	—
Windows	microsoft	windows_10_1809	`10.0.17763.2061`
Windows	microsoft	windows_10_1809	`10.0.18363.1679`
Windows	microsoft	windows_10_1809	`10.0.19041.1110`
Windows	microsoft	windows_10_1809	—
Windows	microsoft	windows_10_1909	`10.0.18363.1679`
Windows	microsoft	windows_10_1909	—
Windows	microsoft	windows_10_2004	—
Windows	microsoft	windows_10_20H2	`10.0.19042.1110`
Windows	microsoft	windows_10_20h2	—
Windows	microsoft	windows_10_21H1	`10.0.19043.1110`
Windows	microsoft	windows_10_21h1	—
Windows	microsoft	windows_8.1	`6.3.9600.20069`
Windows	microsoft	windows_8.1	—
Windows	microsoft	windows_rt_8.1	`6.3.9600.20069`
Windows	microsoft	windows_rt_8.1	—
Windows	microsoft	windows_server_2004	`10.0.19041.1110`
Windows	microsoft	windows_server_2004	—
Windows	microsoft	windows_server_2008	—
Windows	microsoft	windows_server_2012	—
Windows	microsoft	windows_server_2012_R2	`6.3.9600.20069`

Public exploit references

Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

Public exploit references

CISA KEV Catalog	CISA Known Exploited Vulnerability (opens in a new tab)cisa.gov	actively exploited	03.11.2021

References & sources

portal.msrc.microsoft.comen-US/security-guidance/advisory/CVE-2021-33771x_refsource_MISC, x_transferred
Microsoft Security Update GuideWindows Kernel Elevation of Privilege VulnerabilityVendor advisory, Patch
cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2021-33771government-resource

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

10.08.2026NVD analysis modifiedNVD

Product mapping changed:

Microsoft Windows 8.1
Microsoft Windows RT 8.1
Microsoft Windows Server 2012
Microsoft Windows 10 1809 (before 10.0.17763.2061)
Microsoft Windows 10 1909 (before 10.0.18363.1679)
Microsoft Windows 10 21h1 (before 10.0.19043.1110)
Microsoft Windows 10 2004 (before 10.0.19041.1110)
Microsoft Windows Server 2004 (before 10.0.19041.1110)
Microsoft Windows 10 20h2 (before 10.0.19042.1110)
Microsoft Windows Server 20h2 (before 10.0.19042.1110)
Microsoft Windows 10 1507 (before 10.0.10240.19003)
Microsoft Windows 10 1607 (before 10.0.14393.4530)

New references:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-33771

Show 2 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
Product configuration	changed	OR cpe:2.3:o:microsoft:windows_8.1:-::::::: cpe:2.3:o:microsoft:windows_server_2008:-:sp2::::::* cpe:2.3:o:microsoft:windows_rt_8.1:-::::::: cpe:2.3:o:microsoft:windows_server_2008:-:sp1:::::x64: cpe:2.3:o:microsoft:windows_server_2012:-:r2::::::* cpe:2.3:o:microsoft:windows_10_1809::::::::* versions up to (excluding) 10.0.17763.2061 cpe:2.3:o:microsoft:windows_10_1909::::::::* versions up to (excluding) 10.0.18363.1679 cpe:2.3:o:microsoft:windows_10_21h1::::::::* versions up to (excluding) 10.0.19043.1110 cpe:2.3:o:microsoft:windows_10_2004::::::::* versions up to (excluding) 10.0.19041.1110 cpe:2.3:o:microsoft:windows_server_2004::::::::* versions up to (excluding) 10.0.19041.1110 cpe:2.3:o:microsoft:windows_10_20h2::::::::* versions up to (excluding) 10.0.19042.1110 cpe:2.3:o:microsoft:windows_server_20h2::::::::* versions up to (excluding) 10.0.19042.1110 cpe:2.3:o:microsoft:windows_10_1507::::::::* versions up to (excluding) 10.0.10240.19003 cpe:2.3:o:microsoft:windows_10_1607::::::::* versions up to (excluding) 10.0.14393.4530 cpe:2.3:o:microsoft:windows_server_2016::::::::* versions up to (excluding) 10.0.14393.4530 cpe:2.3:o:microsoft:windows_server_2019::::::::* versions up to (excluding) 10.0.17763.2061	OR cpe:2.3:o:microsoft:windows_8.1:-::::::: cpe:2.3:o:microsoft:windows_rt_8.1:-::::::: cpe:2.3:o:microsoft:windows_server_2012:-:r2::::::* cpe:2.3:o:microsoft:windows_10_1809::::::::* versions up to (excluding) 10.0.17763.2061 cpe:2.3:o:microsoft:windows_10_1909::::::::* versions up to (excluding) 10.0.18363.1679 cpe:2.3:o:microsoft:windows_10_21h1::::::::* versions up to (excluding) 10.0.19043.1110 cpe:2.3:o:microsoft:windows_10_2004::::::::* versions up to (excluding) 10.0.19041.1110 cpe:2.3:o:microsoft:windows_server_2004::::::::* versions up to (excluding) 10.0.19041.1110 cpe:2.3:o:microsoft:windows_10_20h2::::::::* versions up to (excluding) 10.0.19042.1110 cpe:2.3:o:microsoft:windows_server_20h2::::::::* versions up to (excluding) 10.0.19042.1110 cpe:2.3:o:microsoft:windows_10_1507::::::::* versions up to (excluding) 10.0.10240.19003 cpe:2.3:o:microsoft:windows_10_1607::::::::* versions up to (excluding) 10.0.14393.4530 cpe:2.3:o:microsoft:windows_server_2016::::::::* versions up to (excluding) 10.0.14393.4530 cpe:2.3:o:microsoft:windows_server_2019::::::::* versions up to (excluding) 10.0.17763.2061
Reference type	added	—	Microsoft Corporation: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-33771 Types: Patch, Vendor Advisory

Source identifier: nvd@nist.gov

10.08.2026Record modifiedMicrosoft

New references:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-33771

Show 4 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
Reference	added	—	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-33771
Reference	removed	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-33771	—
Reference type	removed	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-33771 Types: Patch, Vendor Advisory	—
Affected versions (publisher)	changed	Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation) (+13)	Windows 10 Version 1507, Windows 10 Version 1607, Windows 10 Version 1809 (+14)

Source identifier: secure@microsoft.com

Embed badge

Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

<a href="https://intel.neosec.eu/en/cve/CVE-2021-33771"><img src="https://intel.neosec.eu/badge/cve/CVE-2021-33771.svg?lang=en" alt="CVE-2021-33771 – NEOSEC Intel" height="20"></a>

What is affected, what to do

Metrics

Response and mitigation

Prioritisation rationale

Immediate response (0-24 h)

Mitigation layers

Detection rules

Detection rules

Classification under NIS2 and CRA

Description

Affected products

Vendors and products

Affected operating systems

Public exploit references

References & sources

Changes to this CVE