CVE-2021-34527
Microsoft Windows Print Spooler Remote Code Execution Vulnerability
Description
CVE-2021-34527, widely known as "PrintNightmare," is a high-severity remote code execution vulnerability in the Microsoft Windows Print Spooler service. The Print Spooler service improperly performs privileged file operations, enabling an authenticated attacker to execute arbitrary code with SYSTEM privileges remotely. This allows an attacker to install programs, view, change, or delete data, or create new accounts with full user rights. CISA has confirmed active exploitation by adding CVE-2021-34527 to the Known Exploited Vulnerabilities (KEV) catalog, and it is known to be leveraged in ransomware campaigns. With an EPSS score of 94.27% (99.9th percentile), exploitation is near certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.18969 |
| microsoft | windows 10 1607 | < 10.0.14393.4470 |
| microsoft | windows 10 1809 | < 10.0.17763.2029 |
| microsoft | windows 10 20h2 | < 10.0.19042.1083 |
| microsoft | windows 10 21h2 | < 10.0.19044.1415 |
| microsoft | windows 10 22h2 | < 10.0.19045.2251 |
| microsoft | windows 11 21h2 | < 10.0.22000.318 |
| microsoft | windows 11 22h2 | < 10.0.22621.674 |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.4470 |
| microsoft | windows server 2019 | < 10.0.17763.2029 |
| microsoft | windows server 2022 | < 10.0.20348.230 |
| microsoft | windows server 20h2 | < 10.0.19042.1083 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527(Patch, Vendor Advisory)
- http://packetstormsecurity.com/files/167261/Print-Spooler-Remote-DLL-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527(Mitigation, Patch, Vendor Advisory)
- https://www.kb.cert.org/vuls/id/383432(Third Party Advisory, US Government Resource)
- https://www.vicarius.io/vsociety/posts/cve-2021-34527-printnightmare-detection-script(Exploit, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2021-34527-printnightmare-mitigation-script(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34527(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2021-34527 by NVD. The vulnerability involves improper privileged file operations in the Windows Print Spooler service, which allows authenticated remote attackers to load malicious DLLs and achieve code execution with SYSTEM privileges. The underlying weakness relates to insufficient access control and improper input validation in the Print Spooler's driver installation functionality.
Impact Analysis
CVE-2021-34527 carries a CVSS 3.1 score of 8.8 (HIGH), reflecting a severe remote code execution threat. The vulnerability is remotely exploitable over the network with low attack complexity, requires only low-level authentication, and needs no user interaction, making it highly accessible to attackers with any network foothold. Successful exploitation results in full compromise of confidentiality, integrity, and availability, as the attacker gains SYSTEM-level code execution. The EPSS score of 94.27% (99.9th percentile) indicates near-certain exploitation activity, placing PrintNightmare among the most actively targeted vulnerabilities. This vulnerability is known to be used in ransomware campaigns, greatly amplifying the business risk. The combination of remote exploitability, SYSTEM-level access, and ransomware association makes CVE-2021-34527 one of the most critical Windows vulnerabilities that organizations must address.
Exploit Maturity
CVE-2021-34527 (PrintNightmare) is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, and it is known to be used in ransomware campaigns. Public exploit code is available via Packet Storm Security (Print Spooler Remote DLL Injection), as well as through detection and mitigation scripts published by Vicarius vSociety. The EPSS score of 94.27% (99.9th percentile) indicates near-certain exploitation activity. This vulnerability is commonly chained with CVE-2021-1675, a related Print Spooler vulnerability, where combined exploitation enables a more complete attack scenario. The widespread availability of exploit tools and the critical nature of the Print Spooler service across Windows environments make this vulnerability an immediate remediation priority.
Remediation
- Apply vendor security updates immediately as directed by the CISA KEV catalog: Apply updates per vendor instructions. Install the July 2021 and subsequent security updates from Microsoft that address the Print Spooler remote code execution vulnerability.
- After applying updates, verify that critical registry settings are configured securely: ensure that HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint keys NoWarningNoElevationOnInstall and UpdatePromptSettings are set to 0 or not defined, as having NoWarningNoElevationOnInstall set to 1 makes the system vulnerable by design.
- If immediate patching is not feasible, disable the Print Spooler service on systems where printing is not required, particularly on domain controllers and servers. Use Group Policy to disable the service: Stop-Service -Name Spooler -Force; Set-Service -Name Spooler -StartupType Disabled.
- Restrict printer driver installation to administrators only by configuring Group Policy to prevent non-administrators from installing printer drivers. See Microsoft KB5005010 for guidance on restricting installation of new printer drivers.
- Monitor for indicators of compromise including suspicious DLL loading by the spoolsv.exe process, unexpected printer driver installations, and anomalous network connections on port 445 (SMB) targeting the Print Spooler service.
Technical Details
CVE-2021-34527 (PrintNightmare) is a remote code execution vulnerability in the Windows Print Spooler service where the service improperly performs privileged file operations during printer driver installation. The attack vector is network-based (CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning an authenticated attacker can remotely exploit the vulnerability by connecting to the Print Spooler service and submitting a specially crafted print driver, which causes the service to load a malicious DLL with SYSTEM privileges. The low authentication requirement (any domain user) combined with the fact that the Print Spooler service is enabled by default on most Windows systems, including domain controllers, creates an extremely large attack surface. The vulnerability is closely related to CVE-2021-1675, and the security updates released on and after July 6, 2021 contain protections for both vulnerabilities. The critical registry settings under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint must be properly configured even after patching, as incorrect configuration reintroduces the vulnerability.
Frequently Asked Questions
Is CVE-2021-34527 being actively exploited?
Yes. CVE-2021-34527 (PrintNightmare) is listed in the CISA Known Exploited Vulnerabilities catalog, confirming widespread active exploitation. It is also known to be used in ransomware campaigns. The EPSS score of 94.27% (99.9th percentile) indicates near-certain exploitation activity, making this one of the most critical vulnerabilities to address.
What products are affected by CVE-2021-34527?
CVE-2021-34527 affects the Windows Print Spooler service across virtually all Windows versions, including Windows Server 2012, Windows Server 2016, Windows 10, and other editions where the Print Spooler service is enabled. Domain controllers are particularly at risk as the Print Spooler service is typically enabled by default.
How do I fix CVE-2021-34527?
Apply the July 2021 and subsequent security updates from Microsoft. After patching, verify that the PointAndPrint registry keys are properly configured (NoWarningNoElevationOnInstall = 0). On systems that do not require printing, disable the Print Spooler service entirely. See Microsoft KB5005010 for additional guidance on restricting printer driver installations.
How severe is CVE-2021-34527?
CVE-2021-34527 has a CVSS 3.1 score of 8.8 (HIGH). It enables remote code execution with SYSTEM privileges over the network with minimal prerequisites. Its association with ransomware campaigns and the extremely high EPSS score (94.27%) make immediate remediation critical for all organizations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.