All vulnerabilities
CVE-2021-36942

Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability

Microsoft WindowsOperating systems
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationExploited in the wildAdded to KEV 3 Nov 2021. Known ransomware useCISA KEV
Exploit odds (EPSS)66.0%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.1.7601.25685Also 6.0.6003.21192, 6.2.9200.23435 and 5 moreCVE List
Federal deadline17 Nov 2021Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

  • 6.1.7601.25685Windows Server 2008 R2 Service Pack 1CVE List
  • 6.1.7601.25685Windows Server 2008 R2 Service Pack 1 (Server Core installation)CVE List
  • 6.0.6003.21192Windows Server 2008 Service Pack 2CVE List
  • 6.0.6003.21192Windows Server 2008 Service Pack 2 (Server Core installation)CVE List
  • 6.2.9200.23435Windows Server 2012CVE List
  • 6.2.9200.23435Windows Server 2012 (Server Core installation)CVE List
Show all 14 fixed versions
  • 6.3.9600.20094Windows Server 2012 R2CVE List
  • 6.3.9600.20094Windows Server 2012 R2 (Server Core installation)CVE List
  • 10.0.14393.4583Windows Server 2016CVE List
  • 10.0.14393.4583Windows Server 2016 (Server Core installation)CVE List
  • 10.0.17763.2114Windows Server 2019CVE List
  • 10.0.17763.2114Windows Server 2019 (Server Core installation)CVE List
  • 10.0.19041.1165Windows Server version 2004CVE List
  • 10.0.19042.1165Windows Server version 20H2CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 12 Aug 2021, 18:12 UTCPublishedCVE List
  2. 3 Nov 2021Added to CISA KEVCISA KEV

Public exploit code and templates 1

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.

Text from CVE List

Affected versions 14

  • Windows Server 2008 R2 Service Pack 1affected: 6.1.7601.0 before 6.1.7601.25685CVE List
  • Windows Server 2008 R2 Service Pack 1 (Server Core installation)affected: 6.1.7601.0 before 6.1.7601.25685CVE List
  • Windows Server 2008 Service Pack 2affected: 6.0.6003.0 before 6.0.6003.21192CVE List
  • Windows Server 2008 Service Pack 2 (Server Core installation)affected: 6.0.6003.0 before 6.0.6003.21192CVE List
  • Windows Server 2012affected: 6.2.9200.0 before 6.2.9200.23435CVE List
  • Windows Server 2012 (Server Core installation)affected: 6.2.9200.0 before 6.2.9200.23435CVE List
  • Windows Server 2012 R2affected: 6.3.9600.0 before 6.3.9600.20094CVE List
  • Windows Server 2012 R2 (Server Core installation)affected: 6.3.9600.0 before 6.3.9600.20094CVE List
  • Windows Server 2016affected: 10.0.14393.0 before 10.0.14393.4583CVE List
  • Windows Server 2016 (Server Core installation)affected: 10.0.14393.0 before 10.0.14393.4583CVE List
  • Windows Server 2019affected: 10.0.17763.0 before 10.0.17763.2114CVE List
  • Windows Server 2019 (Server Core installation)affected: 10.0.17763.0 before 10.0.17763.2114CVE List
  • Windows Server version 2004affected: 10.0.0 before 10.0.19041.1165CVE List
  • Windows Server version 20H2affected: 10.0.0 before 10.0.19042.1165CVE List

References 5