CVE-2021-31199VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2021-31199: Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability

Affects Microsoft Enhanced Cryptographic ProviderSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 11/17/2021
EPSS: 3.0% chance of exploitation in 30 days – higher than 87% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-31199 (opens in a new tab)

Description

CVE-2021-31199 is a high-severity vulnerability in the Microsoft Enhanced Cryptographic Provider that allows privilege escalation. The vulnerability is unspecified in detail but has been exploited in the wild. No affected versions or patch information are provided in the available data.

Summary

Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability identified as CVE-2021-31199 that enables privilege escalation. The vulnerability has been confirmed to be exploited in the wild according to CISA KEV data. No detailed technical information or affected versions are provided, and no patch or remediation details are available in the input data.

Impact

Successful exploitation of this vulnerability allows an attacker to escalate privileges on the affected system, potentially gaining higher-level access than intended. This can lead to unauthorized actions and compromise of system security. The vulnerability has been observed in active exploitation scenarios.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Microsoft security advisories for updates and apply any available patches promptly once released.

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:19:48 UTC

References

Related threats