CVE-2021-36942VulnerabilityPublished 11/03/2021Updated 10/24/2026
CVE-2021-36942: Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability
Affects Microsoft WindowsSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 11/03/2021
- KEV deadline
- 11/17/2021
- Ransomware
- Used in ransomware campaigns
- EPSS
- 66.0% chance of exploitation in 30 days – higher than 99% of CVEs
What to do
CISA required action
Apply updates per vendor instructions.
Description
CVE-2021-36942 is a spoofing vulnerability in the Microsoft Windows Local Security Authority (LSA) that allows an unauthenticated attacker to coerce a domain controller to authenticate against another server using NTLM. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.