CVE-2021-36934: Microsoft Windows SAM Local Privilege Escalation Vulnerability

CVE-2021-36934 is a local privilege escalation vulnerability in Microsoft Windows. When a Volume Shadow Copy (VSS) of the system drive exists, ordinary users can read the Security Account Manager (SAM) database file. That access can let any local user raise their privileges to SYSTEM. The issue matters because SYSTEM-level access gives full control of the host, enabling further lateral movement, persistence, or data theft inside an environment. Confirm exact scope and fixed builds against the Microsoft vendor advisory.

How it works

The weakness is classified as CWE-1220 (insufficient granularity of access control). Windows stores account password hashes and related security data in the SAM. Under normal conditions those files are locked and readable only by highly privileged processes. When a VSS shadow copy of the system volume is present, the ACLs on the shadow-copy versions of the SAM (and related registry hives) can be overly permissive. A low-privileged local user can therefore open and read the shadow-copy SAM. With the extracted credential material the attacker can then impersonate or create SYSTEM-level tokens. No remote exploit path is described in the provided facts; the attack requires local code execution or an interactive logon on the affected machine. Exact file paths, tools, or exploitation sequences must be verified against the vendor advisory rather than assumed.

Am I affected? How to find it in your systems

The vulnerability affects Microsoft Windows systems on which Volume Shadow Copies of the system drive have been created. Typical locations include workstations, member servers, and domain controllers that have System Restore, backup software, or manual VSS snapshots enabled. Inventory steps:

• Enumerate Windows hosts via your asset-management or CMDB tools and note build/version information; compare those builds with the list published in the Microsoft advisory for CVE-2021-36934.
• On each host, check for existing shadow copies with the built-in vssadmin list shadows command or equivalent PowerShell (Get-WmiObject Win32_ShadowCopy). Presence of a system-drive shadow copy is a prerequisite for the issue.
• Review local security policy and file ACLs on the shadow-copy volume to confirm whether non-administrative users can read the SAM-related files.
• Hunt for exploitation indicators in endpoint telemetry: unexpected access to harddiskvolumeshadowcopy paths, processes reading SAM or SYSTEM hive files from non-system contexts, or sudden creation of new local administrator accounts. SIEM queries for Event IDs related to sensitive file reads or privilege-use auditing can surface suspicious activity. Because public detail on specific log signatures is limited, treat any anomalous SAM access as worth investigation.

How to remediate

Patch first. Apply the security updates Microsoft released for CVE-2021-36934 exactly as directed in the vendor advisory and in the CISA required action (“Apply updates per vendor instructions”). After patching:

• Reboot if the advisory requires it so that the updated access-control logic takes effect.
• Delete existing system-drive shadow copies that were created before the patch if your backup policy allows; new snapshots taken after the update should inherit corrected permissions.
• Verify that the SAM and related hives under any remaining shadow copies are no longer readable by standard users.
• Harden the broader class of issue by restricting who may create VSS snapshots, enabling stricter object-access auditing on credential stores, and ensuring least-privilege local accounts.

If you can't patch immediately

Implement compensating controls until the vendor update can be deployed:

• Remove or schedule deletion of all Volume Shadow Copies of the system drive (vssadmin delete shadows /all) provided this does not violate backup or recovery requirements.
• Use application control or AppLocker/WDAC policies to block non-administrative tools commonly used to read registry hives or shadow-copy paths.
• Segment high-value hosts so that local user accounts on workstations cannot reach domain controllers or servers that still have the vulnerable configuration.
• Increase monitoring: alert on any process touching HarddiskVolumeShadowCopy* paths or on unexpected reads of SAM/SYSTEM/SECURITY hives. Endpoint detection rules that flag privilege-escalation behaviors provide additional short-term coverage.
• If a host-based firewall or virtual-patching capability is available, restrict local access to the VSS device objects, though this is only a temporary measure and must be validated for operational impact.

If your data may have been exposed

Actively exploited local privilege-escalation flaws can be a stepping stone to broader compromise and data theft, even when ransomware use has not been documented for this CVE. If you suspect the vulnerability was abused, isolate the host, preserve forensic images, rotate credentials that may have been extracted from the SAM, and review authentication logs for follow-on activity. You can also run a free exposure scan of your email addresses against known breach data sets to determine whether associated accounts appear in prior third-party breaches while you complete incident response.