{"schema":"threatline.record/2","record":{"id":"CVE-2021-34527","aliases":[],"summary":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","details":"Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.","categories":["Operating systems"],"product":"Windows","vendor":"Microsoft","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows 10 Version 1507","vendor":"Microsoft","versions":[{"version":"10.0.10240.0","lessThan":"10.0.10240.18969","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"version":"10.0.14393.0","lessThan":"10.0.14393.4470","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"version":"10.0.17763.0","lessThan":"10.0.17763.2029","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"version":"10.0.0","lessThan":"10.0.17763.2029","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows 10 Version 20H2","vendor":"Microsoft","versions":[{"version":"10.0.0","lessThan":"10.0.19042.1083","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"version":"10.0.19044.0","lessThan":"10.0.19044.1415","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"version":"10.0.19045.0","lessThan":"10.0.19045.2251","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows 11 version 21H2","vendor":"Microsoft","versions":[{"version":"10.0.22000.0","lessThan":"10.0.22000.318","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows 11 version 22H2","vendor":"Microsoft","versions":[{"version":"10.0.22621.0","lessThan":"10.0.22621.674","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows 8.1","vendor":"Microsoft","versions":[{"version":"6.3.0","lessThan":"6.3.9600.20046","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows Server 2008 R2 Service Pack 1","vendor":"Microsoft","versions":[{"version":"6.1.7601.0","lessThan":"6.1.7601.25633","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows Server 2008 R2 Service Pack 1 (Server Core installation)","vendor":"Microsoft","versions":[{"version":"6.1.7601.0","lessThan":"6.1.7601.25633","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows Server 2008 Service Pack 2","vendor":"Microsoft","versions":[{"version":"6.0.6003.0","lessThan":"6.0.6003.21138","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows Server 2008 Service Pack 2 (Server Core installation)","vendor":"Microsoft","versions":[{"version":"6.0.6003.0","lessThan":"6.0.6003.21138","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows Server 2012","vendor":"Microsoft","versions":[{"version":"6.2.9200.0","lessThan":"6.2.9200.23383","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows Server 2012 (Server Core installation)","vendor":"Microsoft","versions":[{"version":"6.2.9200.0","lessThan":"6.2.9200.23383","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows Server 2012 R2","vendor":"Microsoft","versions":[{"version":"6.3.9600.0","lessThan":"6.3.9600.20046","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows Server 2012 R2 (Server Core installation)","vendor":"Microsoft","versions":[{"version":"6.3.9600.0","lessThan":"6.3.9600.20046","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows Server 2016","vendor":"Microsoft","versions":[{"version":"10.0.14393.0","lessThan":"10.0.14393.4470","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"version":"10.0.14393.0","lessThan":"10.0.14393.4470","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows Server 2019","vendor":"Microsoft","versions":[{"version":"10.0.17763.0","lessThan":"10.0.17763.2029","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"version":"10.0.17763.0","lessThan":"10.0.17763.2029","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows Server 2022","vendor":"Microsoft","versions":[{"version":"10.0.20348.0","lessThan":"10.0.20348.230","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Windows Server version 20H2","vendor":"Microsoft","versions":[{"version":"10.0.0","lessThan":"10.0.19042.1083","versionType":"custom","status":"affected"}],"defaultStatus":null}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows 10 Version 1507","ecosystem":null},"version":"10.0.10240.18969","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows 10 Version 1607","ecosystem":null},"version":"10.0.14393.4470","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows 10 Version 1809","ecosystem":null},"version":"10.0.17763.2029","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows 10 Version 20H2","ecosystem":null},"version":"10.0.19042.1083","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows 10 Version 21H2","ecosystem":null},"version":"10.0.19044.1415","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows 10 Version 22H2","ecosystem":null},"version":"10.0.19045.2251","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows 11 version 21H2","ecosystem":null},"version":"10.0.22000.318","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows 11 version 22H2","ecosystem":null},"version":"10.0.22621.674","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows 8.1","ecosystem":null},"version":"6.3.9600.20046","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows Server 2008 R2 Service Pack 1","ecosystem":null},"version":"6.1.7601.25633","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows Server 2008 R2 Service Pack 1 (Server Core installation)","ecosystem":null},"version":"6.1.7601.25633","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows Server 2008 Service Pack 2","ecosystem":null},"version":"6.0.6003.21138","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows Server 2008 Service Pack 2 (Server Core installation)","ecosystem":null},"version":"6.0.6003.21138","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows Server 2012","ecosystem":null},"version":"6.2.9200.23383","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows Server 2012 (Server Core installation)","ecosystem":null},"version":"6.2.9200.23383","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows Server 2012 R2","ecosystem":null},"version":"6.3.9600.20046","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows Server 2012 R2 (Server Core installation)","ecosystem":null},"version":"6.3.9600.20046","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows Server 2016","ecosystem":null},"version":"10.0.14393.4470","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows Server 2016 (Server Core installation)","ecosystem":null},"version":"10.0.14393.4470","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows Server 2019","ecosystem":null},"version":"10.0.17763.2029","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows Server 2019 (Server Core installation)","ecosystem":null},"version":"10.0.17763.2029","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows Server 2022","ecosystem":null},"version":"10.0.20348.230","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","source_modified_at":"2026-08-10T15:12:05.065Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Windows Server version 20H2","ecosystem":null},"version":"10.0.19042.1083","basis":"first unaffected version stated in the CVE record"}],"cvss":8.8,"severity":"High","kev":{"listed":true,"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","ransomware_campaign_use":"Known"},"epss":{"probability":0.99792,"percentile":0.99956,"score_date":"2026-10-23"},"published_at":"2021-07-02T21:25:11.000Z","modified_at":"2026-08-10T15:12:05.065Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2021-34527","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-08-10T15:12:05.065Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2021-06-08"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-34527","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","Metasploit","EPSS"],"references":[{"source":"CVE List","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527","tags":["vendor-advisory","patch"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34527","tags":["government-resource"]},{"source":"CVE List","url":"https://www.vicarius.io/vsociety/posts/cve-2021-34527-printnightmare-detection-script"},{"source":"CVE List","url":"https://www.vicarius.io/vsociety/posts/cve-2021-34527-printnightmare-mitigation-script"},{"source":"CVE List","url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://www.kb.cert.org/vuls/id/383432"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"no","technical_impact":"total","assessed_at":"2024-01-24T16:04:14.042095Z"},"exploits":[{"source":"Metasploit","kind":"Exploit module","name":"Print Spooler Remote DLL Injection","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb","date":"2021-06-08","added":"2026-03-11","check":true}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-08-10T15:12:05.065Z","content_hash":"40dfef597e1199ee2b36324b0b67493c52c312ddf8ed5773360319a74f79dab2"}}