CVE-2021-36934
Microsoft Windows SAM Local Privilege Escalation Vulnerability
Description
CVE-2021-36934, also known as "HiveNightmare" or "SeriousSAM," is a HIGH severity privilege escalation vulnerability in Microsoft Windows 10 that allows a local user to read the Security Account Manager (SAM) database file when a Volume Shadow Copy (VSS) is available. The flaw results from overly permissive access control lists (ACLs) on system files including SAM, SYSTEM, and SECURITY registry hives, allowing any authenticated user to read these sensitive files and extract password hashes. With a CVSS 3.1 score of 7.8 and an EPSS score of 0.9056 (99.6th percentile), this vulnerability exhibits extremely high exploitation activity. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 24, 2022, though no specific ransomware association is documented.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1809 | < 10.0.17763.2114 |
| microsoft | windows 10 1909 | < 10.0.18363.1734 |
| microsoft | windows 10 2004 | < 10.0.19041.1165 |
| microsoft | windows 10 20h2 | < 10.0.19042.1165 |
| microsoft | windows 10 21h1 | < 10.0.19043.1165 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934(Patch, Vendor Advisory)
- http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.html(Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934(Patch, Vendor Advisory)
- https://www.kb.cert.org/vuls/id/506989(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36934(US Government Resource)
Weakness Type
Improper Access Control on System Files
Improper access control vulnerabilities occur when the operating system or application assigns overly permissive permissions to sensitive files, directories, or resources, allowing unauthorized users to read, modify, or execute protected data. In the context of operating system security, the access control lists (ACLs) on system files are a fundamental security boundary — they determine which user accounts can access critical system data. When these ACLs are misconfigured, the entire security model of the operating system can be undermined because attackers can access credentials, security policies, and other sensitive system information that should be restricted to administrators.
In CVE-2021-36934, multiple Windows 10 builds contain overly permissive ACLs on the SAM (Security Account Manager), SYSTEM, and SECURITY registry hive files stored in C:\Windows\System32\config\. These files contain password hashes, cached credentials, machine account secrets, and security policy data. Under normal circumstances, these files are locked by the operating system and readable only by SYSTEM. However, the permissive ACLs allow any authenticated user to read these files from Volume Shadow Copies (VSS snapshots), which are not subject to the same file-locking protection. This means any local user with a standard account can extract the complete SAM database. Learn more about access control weaknesses at MITRE CWE resources.
Impact Analysis
CVE-2021-36934 carries a CVSS 3.1 score of 7.8 (HIGH) with an Unchanged scope, reflecting severe impact on the local system's security posture.
Confidentiality (High): The most significant impact is on confidentiality. An attacker can read the SAM database containing NTLM password hashes for all local user accounts, the SYSTEM hive containing the machine account password and stored credentials, and the SECURITY hive containing cached domain credentials and security policies. This data enables offline password cracking, pass-the-hash attacks against other systems, and extraction of stored credentials for domain accounts. In enterprise environments, extracting the machine account hash can enable Silver Ticket and other Active Directory attacks.
Integrity (High): While the vulnerability itself only provides read access to system files, the credentials obtained enable an attacker to escalate to SYSTEM or administrator privileges, after which they can modify any file or system setting. Extracted password hashes can be used in pass-the-hash attacks to authenticate as administrators, install backdoors, modify security policies, and tamper with audit logs. The integrity impact is therefore high through the credential exploitation chain.
Availability (High): With administrator or SYSTEM access achieved through credential extraction, an attacker can disrupt any service, terminate processes, delete files, or render the system inoperable. The ability to modify security configurations also enables persistent denial of service through policy changes that lock out legitimate administrators.
Scope (Unchanged): The scope is Unchanged as the impact is within the Windows operating system. However, credentials extracted from the SAM database can be used to attack other systems on the network through pass-the-hash and credential reuse attacks. The EPSS score of 0.9056 at the 99.6th percentile confirms that this vulnerability is among the most actively exploited in the current threat landscape.
Exploit Maturity
Active Exploitation: CVE-2021-36934 has been actively exploited since its public disclosure in July 2021. The vulnerability quickly gained attention because exploitation requires only standard user privileges and a simple command-line tool. CISA added it to the KEV catalog on February 10, 2022, confirming documented exploitation in the wild.
Ransomware Association: CISA's KEV catalog does not flag a specific ransomware association for CVE-2021-36934. However, the privilege escalation capability it provides is a critical enabler for ransomware operations, as attackers commonly need elevated privileges to encrypt files system-wide and disable security products.
Public Exploits: A complete exploit tool called "HiveNightmare" (also known as "SeriousSAM") is publicly available on Packet Storm Security. This tool automates the extraction of SAM, SYSTEM, and SECURITY hive files from VSS shadow copies, making exploitation trivially easy for any attacker with local access. The availability of polished, user-friendly exploit tools has significantly amplified the threat.
EPSS Context: The EPSS score of 0.9056 at the 99.6th percentile indicates near-certain exploitation activity. The combination of trivial exploitation requirements (any local user, no special tools needed beyond publicly available exploits), the high value of extracted credentials, and the widespread deployment of affected Windows 10 versions drives this extreme score.
KEV Remediation Deadline: CISA established a remediation deadline of February 24, 2022. Organizations running affected Windows 10 builds without the security update and ACL remediation remain at critical risk.
Remediation
-
Install the Microsoft security update for CVE-2021-36934. Apply the cumulative security update from Microsoft's advisory for Windows 10 versions 1809, 1909, 2004, 20H2, and 21H1. The update corrects the ACLs on the SAM, SYSTEM, and SECURITY registry hive files to restrict access to SYSTEM only.
-
Delete existing Volume Shadow Copies after patching. The security update corrects the ACLs on active system files but does not remediate shadow copies created while the vulnerability existed. Delete all existing VSS shadow copies using the command
vssadmin delete shadows /all /quietto remove copies that contain the vulnerable file permissions. Then create a new restore point to maintain system recovery capability. -
Manually verify and correct ACLs on system registry hives. After applying the update, verify that the ACLs on
C:\Windows\System32\config\SAM,SYSTEM, andSECURITYfiles restrict read access to SYSTEM and Administrators only. Useicacls C:\Windows\System32\config\SAMto inspect current permissions and correct any remaining overly permissive entries. -
Rotate all local account passwords on affected systems. Assume that password hashes for all local accounts on affected systems may have been compromised. Change passwords for all local user accounts, especially the local Administrator account. If the machine is domain-joined, consider resetting the machine account password and rotating any cached domain credentials.
-
Audit systems for indicators of credential extraction. Review Security Event Logs for suspicious access patterns to SAM-related files and VSS shadow copies. Monitor for lateral movement using local account credentials through pass-the-hash attacks. Check for unauthorized use of tools like secretsdump, mimikatz, or HiveNightmare on endpoints.
-
Implement credential theft detection and monitoring. Deploy detection rules for SAM database extraction techniques including monitoring for
vssadminandwmic shadowcopycommands executed by non-administrator users, access to VSS mount points by standard user accounts, and extraction tools being downloaded or executed on endpoints.
Technical Details
CVE-2021-36934 is a local privilege escalation vulnerability in Microsoft Windows 10 caused by overly permissive access control lists (ACLs) on critical system files. Specifically, the SAM (Security Account Manager), SYSTEM, and SECURITY registry hive files located in C:\Windows\System32\config\ have ACLs that grant read access to the BUILTIN\Users group, rather than restricting access to SYSTEM and Administrators only.
Under normal operation, these files are locked by the operating system kernel and cannot be opened directly by user processes, even with read permissions. However, the Volume Shadow Copy Service (VSS) creates point-in-time snapshots of the system volume that include these files. Shadow copies are not subject to the kernel's file-locking mechanism, meaning the permissive ACLs allow any authenticated user to read the SAM, SYSTEM, and SECURITY files from VSS snapshots.
The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local attack vector requiring low privileges and no user interaction. The attack complexity is low because the only prerequisite is the existence of at least one VSS shadow copy, which is common on systems with System Restore enabled (the default). Exploitation involves enumerating VSS shadow copies, mounting or accessing them, and copying the registry hive files for offline analysis.
The extracted SAM file contains NTLM password hashes for all local accounts, which can be cracked offline or used directly in pass-the-hash attacks. The SYSTEM file contains the boot key required to decrypt the SAM hashes, and the SECURITY file contains cached domain logon credentials and LSA secrets. Together, these files provide complete credential access for the local system and potentially cached domain credentials. The root cause is an ACL regression introduced in Windows 10 builds where the system file permissions were inadvertently relaxed during a Windows update.
Frequently Asked Questions
What is CVE-2021-36934 (HiveNightmare)?
CVE-2021-36934, nicknamed "HiveNightmare" or "SeriousSAM," is a privilege escalation vulnerability in Windows 10 that allows any local user to read the SAM database containing password hashes for all local accounts. The vulnerability results from overly permissive file permissions (ACLs) on the SAM, SYSTEM, and SECURITY registry hive files, combined with the ability to access these files through Volume Shadow Copy snapshots. It carries a CVSS 3.1 score of 7.8 (HIGH) and an EPSS score of 0.9056 (99.6th percentile).
Which Windows versions are affected by CVE-2021-36934?
CVE-2021-36934 affects Windows 10 versions 1809, 1909, 2004, 20H2, and 21H1. The vulnerability was introduced through an ACL regression in Windows 10 updates. Earlier Windows versions (Windows 7, Windows 8.1) and Windows Server versions are generally not affected because they maintain restrictive ACLs on the system registry hive files. Users should verify their specific build number against Microsoft's advisory to confirm vulnerability status.
What can an attacker do with CVE-2021-36934?
An attacker who exploits CVE-2021-36934 can extract the complete SAM database containing NTLM password hashes for all local accounts, cached domain credentials, machine account secrets, and LSA secrets. These credentials enable offline password cracking, pass-the-hash attacks against the local system and other network hosts, and potentially Active Directory attacks using the extracted machine account hash. The publicly available HiveNightmare tool makes exploitation trivially simple.
How do I fully remediate CVE-2021-36934?
Full remediation requires three steps: First, install the Microsoft security update that corrects the file ACLs. Second, delete all existing Volume Shadow Copies using vssadmin delete shadows /all /quiet because shadow copies created before the patch still contain files with permissive ACLs. Third, create a new system restore point. Additionally, rotate all local account passwords on affected systems and audit for signs of prior credential extraction.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.