CVE-2021-34527VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2021-34527: Microsoft Windows Print Spooler Remote Code Execution Vulnerability

Affects Microsoft WindowsSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
Ransomware: Used in ransomware campaigns
EPSS: 99.8% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

Description

CVE-2021-34527, also known as PrintNightmare, is a high-severity remote code execution vulnerability in the Microsoft Windows Print Spooler service. It arises from improper privileged file operations by the service, allowing attackers to execute code remotely with SYSTEM-level privileges. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions are stated in the provided data.

Summary

Microsoft Windows Print Spooler contains an unspecified vulnerability (CVE-2021-34527) due to improper privileged file operations by the Print Spooler service. Successful exploitation enables remote code execution with SYSTEM privileges. The vulnerability is widely known as PrintNightmare and has been actively exploited in the wild, including use in ransomware campaigns. The input data does not specify affected versions or patch availability.

Impact

Exploitation of this vulnerability allows an attacker to execute arbitrary code remotely with SYSTEM privileges on affected Windows systems. This can lead to full system compromise, enabling attackers to install programs, view, change, or delete data, or create new accounts with full user rights. The vulnerability has been exploited in the wild and is associated with ransomware campaigns, indicating active threat and significant risk to affected systems.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisory content are provided, it is critical to consult Microsoft's official security advisories for updates and apply any available patches or mitigations promptly. Until patched, consider disabling the Print Spooler service if not required or restrict its use according to Microsoft's recommendations.

Weaknesses

CWE-269Improper Privilege Management (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:12:17 UTC

Weaknesses

References

Related threats