All vulnerabilities
CVE-2021-31956

Microsoft Windows NTFS Privilege Escalation Vulnerability

Microsoft WindowsOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationExploited in the wildAdded to KEV 3 Nov 2021CISA KEV
Exploit odds (EPSS)22.3%Chance of exploitation activity in the next 30 days, higher than 97% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.0.17763.1999Also 10.0.18363.1621, 10.0.19043.1052 and 9 moreCVE List
Federal deadline17 Nov 2021Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

  • 10.0.17763.1999Windows 10 Version 1809CVE List
  • 10.0.17763.1999Windows Server 2019CVE List
  • 10.0.17763.1999Windows Server 2019 (Server Core installation)CVE List
  • 10.0.18363.1621Windows 10 Version 1909CVE List
  • 10.0.19043.1052Windows 10 Version 21H1CVE List
  • 10.0.19041.1052Windows 10 Version 2004CVE List
Show all 28 fixed versions
  • 10.0.19041.1052Windows Server version 2004CVE List
  • 10.0.19042.1052Windows 10 Version 20H2CVE List
  • 10.0.19042.1052Windows Server version 20H2CVE List
  • 10.0.10240.18967Windows 10 Version 1507CVE List
  • 10.0.14393.4467Windows 10 Version 1607CVE List
  • 10.0.14393.4467Windows Server 2016CVE List
  • 10.0.14393.4467Windows Server 2016 (Server Core installation)CVE List
  • 6.1.7601.25632Windows 7CVE List
  • 6.1.7601.25632Windows 7 Service Pack 1CVE List
  • 6.3.9600.20045Windows 8.1CVE List
  • 6.3.9600.20044Windows 8.1CVE List
  • 6.0.6003.21137Windows Server 2008 Service Pack 2CVE List
  • 6.0.6003.21137Windows Server 2008 Service Pack 2 (Server Core installation)CVE List
  • 6.0.6003.21137Windows Server 2008 Service Pack 2CVE List
  • 6.1.7601.25632Windows Server 2008 R2 Service Pack 1CVE List
  • 6.1.7601.25632Windows Server 2008 R2 Service Pack 1 (Server Core installation)CVE List
  • 6.2.9200.23372Windows Server 2012CVE List
  • 6.2.9200.23372Windows Server 2012 (Server Core installation)CVE List
  • 6.3.9600.20045Windows Server 2012 R2CVE List
  • 6.3.9600.20044Windows Server 2012 R2CVE List
  • 6.3.9600.20045Windows Server 2012 R2 (Server Core installation)CVE List
  • 6.3.9600.20044Windows Server 2012 R2 (Server Core installation)CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 8 Jun 2021, 22:46 UTCPublishedCVE List
  2. 3 Nov 2021Added to CISA KEVCISA KEV

Description

Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application.

Text from CVE List

Affected versions 28

  • Windows 10 Version 1809affected: 10.0.0 before 10.0.17763.1999CVE List
  • Windows Server 2019affected: 10.0.0 before 10.0.17763.1999CVE List
  • Windows Server 2019 (Server Core installation)affected: 10.0.0 before 10.0.17763.1999CVE List
  • Windows 10 Version 1909affected: 10.0.0 before 10.0.18363.1621CVE List
  • Windows 10 Version 21H1affected: 10.0.0 before 10.0.19043.1052CVE List
  • Windows 10 Version 2004affected: 10.0.0 before 10.0.19041.1052CVE List
  • Windows Server version 2004affected: 10.0.0 before 10.0.19041.1052CVE List
  • Windows 10 Version 20H2affected: 10.0.0 before 10.0.19042.1052CVE List
  • Windows Server version 20H2affected: 10.0.0 before 10.0.19042.1052CVE List
  • Windows 10 Version 1507affected: 10.0.0 before 10.0.10240.18967CVE List
  • Windows 10 Version 1607affected: 10.0.0 before 10.0.14393.4467CVE List
  • Windows Server 2016affected: 10.0.0 before 10.0.14393.4467CVE List
  • Windows Server 2016 (Server Core installation)affected: 10.0.0 before 10.0.14393.4467CVE List
  • Windows 7affected: 6.1.0 before 6.1.7601.25632CVE List
  • Windows 7 Service Pack 1affected: 6.1.0 before 6.1.7601.25632CVE List
  • Windows 8.1affected: 6.3.0 before 6.3.9600.20045CVE List
  • Windows 8.1affected: 6.3.0 before 6.3.9600.20044CVE List
  • Windows Server 2008 Service Pack 2affected: 6.0.0 before 6.0.6003.21137CVE List
  • Windows Server 2008 Service Pack 2 (Server Core installation)affected: 6.0.0 before 6.0.6003.21137CVE List
  • Windows Server 2008 Service Pack 2affected: 6.0.0 before 6.0.6003.21137CVE List
  • Windows Server 2008 R2 Service Pack 1affected: 6.1.0 before 6.1.7601.25632CVE List
  • Windows Server 2008 R2 Service Pack 1 (Server Core installation)affected: 6.0.0 before 6.1.7601.25632CVE List
  • Windows Server 2012affected: 6.2.0 before 6.2.9200.23372CVE List
  • Windows Server 2012 (Server Core installation)affected: 6.2.0 before 6.2.9200.23372CVE List
  • Windows Server 2012 R2affected: 6.3.0 before 6.3.9600.20045CVE List
  • Windows Server 2012 R2affected: 6.3.0 before 6.3.9600.20044CVE List
  • Windows Server 2012 R2 (Server Core installation)affected: 6.3.0 before 6.3.9600.20045CVE List
  • Windows Server 2012 R2 (Server Core installation)affected: 6.3.0 before 6.3.9600.20044CVE List

References 3