CVE-2021-36948
Microsoft Windows Update Medic Service Privilege Escalation Vulnerability
Description
CVE-2021-36948 is a HIGH privilege escalation vulnerability in the Microsoft Windows Update Medic Service, carrying a CVSS 3.1 score of 7.8. The Windows Update Medic Service (WaaSMedicSVC) is designed to repair Windows Update components and ensure that update operations continue without interruption. This vulnerability allows a locally authenticated attacker with low privileges to escalate to SYSTEM-level access. It was exploited as a zero-day in the wild before the August 2021 Patch Tuesday disclosure. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. With an EPSS score of 0.00971 (76.43rd percentile), the exploitation likelihood is moderate but the confirmed zero-day exploitation warrants priority remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1809 | < 10.0.17763.2114 |
| microsoft | windows 10 1909 | < 10.0.18363.1734 |
| microsoft | windows 10 2004 | < 10.0.19041.1165 |
| microsoft | windows 10 20h2 | < 10.0.19042.1165 |
| microsoft | windows 10 21h1 | < 10.0.19043.1165 |
| microsoft | windows server 2004 | < 10.0.19041.1165 |
| microsoft | windows server 2019 | < 10.0.17763.2114 |
| microsoft | windows server 20h2 | < 10.0.19042.1165 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36948(Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36948(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36948(US Government Resource)
Weakness Type
Unspecified Weakness Type
CVE-2021-36948 does not have an officially assigned CWE classification. The vulnerability resides in the Windows Update Medic Service (WaaSMedicSVC), a Windows system service that automatically repairs Windows Update components. The service runs with SYSTEM privileges and can be triggered by low-privileged users.
The weakness involves improper handling of service operations that allows a locally authenticated user to manipulate the service's execution context to gain elevated privileges. The Windows Update Medic Service was specifically designed to be resilient and self-healing, but this same design principle created an exploitable privilege escalation path when the service processes certain requests from lower-privileged callers.
Impact Analysis
CVE-2021-36948 carries a CVSS 3.1 score of 7.8 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker SYSTEM-level access, enabling access to all data on the affected Windows system, including protected files, registry secrets, credential stores, and encrypted data accessible only to SYSTEM.
Integrity (HIGH): With SYSTEM privileges, attackers can modify any file on the system, alter security policies, disable security software, install rootkits, modify boot records, and make any system configuration change.
Availability (HIGH): Complete system disruption is possible, including disabling Windows Update functionality, corrupting the operating system, destroying data, or rendering the system unbootable through destructive operations performed with SYSTEM privileges.
Scope Unchanged: The vulnerability impact is contained within the Windows operating system environment. However, SYSTEM-level access on a domain-joined machine can often be leveraged for lateral movement and domain compromise.
The confirmed zero-day exploitation status makes this vulnerability particularly noteworthy despite the moderate EPSS score of 0.00971 (76.43rd percentile).
Exploit Maturity
CVE-2021-36948 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability was exploited as a zero-day before Microsoft's August 2021 Patch Tuesday disclosure. Microsoft confirmed active exploitation at the time of patch release. The EPSS score of 0.00971 (76.43rd percentile) is relatively moderate, suggesting the exploitation was targeted rather than widespread.
Ransomware association: As of the latest KEV data, no direct ransomware association has been confirmed for CVE-2021-36948. The zero-day exploitation suggests use by a sophisticated threat actor for targeted operations rather than commodity attacks.
Attack surface: The vulnerability requires local access and low-level authentication, limiting the attack surface to scenarios where an attacker has already gained initial foothold on a Windows system. It serves as a privilege escalation step in a multi-stage attack chain rather than an initial access vector.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17. The zero-day exploitation status makes timely patching critical for all organizations.
Remediation
- Apply vendor patches immediately. Apply the August 2021 Patch Tuesday updates per Microsoft's instructions. Consult the Microsoft advisory at MSRC for specific patch guidance.
- Verify affected systems in your environment. Identify all Windows 10 and Windows Server systems that have the Windows Update Medic Service installed. Use WSUS, SCCM, or other patch management tools to verify the August 2021 updates are applied.
- Monitor for privilege escalation indicators. Implement monitoring for suspicious activity related to the WaaSMedicSVC service, including unexpected service interactions, privilege changes, and anomalous process creation chains involving the Update Medic Service.
- Implement defense-in-depth measures. Enforce the principle of least privilege to limit the number of accounts that could be used as an initial foothold. Deploy endpoint detection and response (EDR) solutions that can detect privilege escalation attempts.
- Scan for signs of prior exploitation. Given the confirmed zero-day exploitation, investigate systems for indicators of compromise, particularly those that were unpatched during the exploitation window (before August 2021). Look for unexpected SYSTEM-level processes or security tool modifications.
- Review endpoint security posture. Ensure Windows Update is functioning properly on all systems and that the Update Medic Service has not been tampered with. Verify that security software and monitoring agents are running with expected configurations.
Technical Details
CVE-2021-36948 is a HIGH-severity privilege escalation vulnerability in the Windows Update Medic Service that requires local access. The attack complexity is low, low-level privileges are required, and no user interaction is needed.
Technical mechanism: The Windows Update Medic Service (WaaSMedicSVC) runs as NT AUTHORITY\SYSTEM and is designed to automatically repair Windows Update components. The vulnerability exists in how the service handles certain operations when triggered by lower-privileged callers. An authenticated local user can exploit this flaw to execute code in the security context of the WaaSMedicSVC service, effectively escalating from a standard user to SYSTEM privileges.
Zero-day exploitation context: Microsoft acknowledged this vulnerability was being actively exploited at the time of the August 2021 Patch Tuesday release. The vulnerability was likely used in targeted attacks as a privilege escalation step after initial access was gained through other means. The targeted nature of the exploitation is reflected in the relatively moderate EPSS score.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects local access required, low complexity, low privileges needed, no user interaction, unchanged scope, and high impact across all three CIA dimensions.
Frequently Asked Questions
Is CVE-2021-36948 being actively exploited?
Yes, CVE-2021-36948 was exploited as a zero-day in the wild before Microsoft's disclosure in August 2021. It is listed in CISA's KEV catalog. The exploitation appears to have been targeted rather than widespread, as reflected in the moderate EPSS score of 0.00971 (76.43rd percentile).
Which products are affected by CVE-2021-36948?
CVE-2021-36948 affects the Windows Update Medic Service (WaaSMedicSVC) in Microsoft Windows. This service is present on Windows 10 and Windows Server systems. All systems that had not applied the August 2021 Patch Tuesday updates were vulnerable.
How do I fix CVE-2021-36948?
Apply the August 2021 Patch Tuesday updates from Microsoft. Use WSUS, SCCM, or other patch management tools to verify all Windows systems are updated. Monitor for privilege escalation indicators related to the WaaSMedicSVC service. Given the zero-day status, scan previously unpatched systems for indicators of compromise.
How severe is CVE-2021-36948?
CVE-2021-36948 is rated HIGH with a CVSS 3.1 score of 7.8. While the EPSS score of 0.00971 is moderate, the confirmed zero-day exploitation makes this a high-priority remediation target. The vulnerability enables local privilege escalation to SYSTEM, and CISA required remediation by 2021-11-17.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.