CVE-2021-36942: Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability

CVE-2021-36942 is a spoofing vulnerability in the Local Security Authority (LSA) component of Microsoft Windows. An unauthenticated attacker can abuse the LSARPC interface to coerce a domain controller into authenticating to another server with NTLM. Because domain controllers hold the keys to Active Directory trust, successful abuse can lead to credential theft, lateral movement, and further compromise. CISA notes known ransomware use of this issue, so organizations running Windows domain infrastructure should treat it as a priority.

Public detail is limited to the CISA description and the vendor’s classification; confirm exact affected builds, patch identifiers, and any configuration prerequisites directly against the Microsoft advisory before acting.

How it works

The weakness is catalogued as CWE-749 (Exposed Dangerous Method or Function). In practical terms, the LSA exposes a method on the LSARPC interface that an unauthenticated remote caller can invoke. When that method is called in a crafted way, the domain controller is coerced into initiating an NTLM authentication attempt toward a server of the attacker’s choosing. The attacker can then capture or relay the resulting NTLM material. No further exploit mechanics are supplied in the public summary; defenders should treat any unauthenticated ability to force a domain controller to authenticate outbound as high risk and verify the precise call sequence and preconditions in the vendor advisory.

Am I affected? How to find it in your systems

The vulnerability affects Microsoft Windows systems that host or interact with the Local Security Authority, most critically domain controllers. Inventory every Windows domain controller, RODC, and any member server that exposes LSARPC. Use your existing asset-management or configuration-management database, Active Directory site topology, and endpoint inventory tools to list machines running the LSA service. Because exact version ranges are not restated here, compare each system’s build and patch level against the Microsoft security update guide for CVE-2021-36942.

Telemetry that may indicate attempted abuse includes unusual outbound NTLM authentication traffic originating from domain controllers, LSARPC calls from unexpected source addresses, and authentication attempts toward non-domain servers. Review Windows Security event logs for NTLM events, LSASS-related auditing, and any network flow data that shows domain controllers initiating SMB or RPC connections to unfamiliar hosts. Confirm log signatures and detection guidance with the vendor advisory and your SIEM content packs.

How to remediate

Apply the security updates Microsoft released for this vulnerability, following the vendor’s installation instructions and reboot guidance. CISA’s required action is simply to apply those updates per vendor instructions. After patching, verify the update is present with your patch-management console or by checking the system’s update history.

Beyond the patch, harden NTLM usage across the estate: prefer Kerberos, restrict NTLM where possible via Group Policy, and ensure domain controllers do not initiate outbound authentication to untrusted networks. Review and tighten RPC and SMB filtering so that only authorized management hosts can reach LSARPC endpoints. These steps reduce the attack surface of the broader LSA and NTLM classes even after the specific CVE is closed.

If you can't patch immediately

Until the vendor update can be deployed, isolate domain controllers on tightly controlled network segments and restrict inbound RPC/LSARPC access to known administrative jump hosts only. Consider temporary host-based firewall rules or network ACLs that block unsolicited LSARPC traffic from non-domain subnets. If a web application firewall or RPC-aware filter is in place, enable any vendor-supplied virtual-patch signatures for this CVE once they are published. Disable unnecessary NTLM fallback where business applications allow it, and increase monitoring for outbound NTLM from domain controllers. These compensating controls lower the likelihood of successful coercion but are not substitutes for the official patch.

If your data may have been exposed

Actively exploited vulnerabilities, especially those with known ransomware use, frequently precede broader breaches. If you have evidence of exploitation or simply want to check whether credentials tied to your organization already appear in known breach corpora, run a free exposure scan of your email addresses against aggregated breach data sets. Rotate any potentially exposed privileged credentials, review domain-controller event logs for anomalous authentication, and continue with full patching and incident-response procedures.