CVE-2021-36955
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Description
CVE-2021-36955 is a high-severity privilege escalation vulnerability in the Microsoft Windows Common Log File System (CLFS) driver. The CLFS driver contains an unspecified flaw that allows a local attacker with low-level privileges to escalate to higher system privileges. CISA has added CVE-2021-36955 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Critically, this vulnerability is known to be used in ransomware campaigns. With an EPSS score of 20.64% (95.5th percentile), the probability of exploitation is very high, making immediate remediation essential for all affected Windows deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19060 |
| microsoft | windows 10 1607 | < 10.0.14393.4651 |
| microsoft | windows 10 1809 | < 10.0.17763.2183 |
| microsoft | windows 10 1909 | < 10.0.18363.1801 |
| microsoft | windows 10 2004 | < 10.0.19041.1237 |
| microsoft | windows 10 20h2 | < 10.0.19042.1237 |
| microsoft | windows 10 21h1 | < 10.0.19043.1237 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2004 | < 10.0.19041.1237 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | - |
| microsoft | windows server 2016 | < 10.0.14393.4651 |
| microsoft | windows server 2019 | < 10.0.17763.2183 |
| microsoft | windows server 2022 | < 10.0.20348.230 |
| microsoft | windows server 20h2 | < 10.0.19042.1237 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36955(Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36955(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36955(US Government Resource)
Weakness Type
Privilege Escalation via CLFS Driver
The Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows privilege escalation. The CLFS driver is a kernel-mode component responsible for managing transaction log files, and flaws in its processing logic can be leveraged by attackers to execute code with elevated privileges, potentially gaining full SYSTEM-level access.
Learn more: CVE-2021-36955 — NVD Detail
Impact Analysis
CVE-2021-36955 carries a CVSS 3.1 score of 7.8 (HIGH), representing a serious threat to Windows infrastructure. The vulnerability is locally exploitable with low attack complexity, requires only low-level privileges, and needs no user interaction, making it highly accessible to any authenticated attacker on the system. Successful exploitation results in full compromise of confidentiality, integrity, and availability, as the attacker gains elevated privileges through the kernel-mode CLFS driver. This vulnerability is known to be used in ransomware operations, significantly increasing its real-world threat level. The EPSS score of 20.64% (95.5th percentile) indicates a very high probability of active exploitation, placing CVE-2021-36955 among the top 5% of all CVEs most likely to be exploited.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-36955 in the wild through its listing in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2021-11-17 that has long passed. This vulnerability is known to be leveraged by ransomware operators, making it a critical priority for defensive teams. The EPSS score of 20.64% (95.5th percentile) indicates a very high probability of exploitation. While no specific public exploit code has been identified in the available references, the confirmed active exploitation and ransomware association demonstrate that working exploits are actively circulating in threat actor toolkits.
Remediation
- Apply Microsoft security updates immediately as required by CISA KEV guidance. The patch was released as part of the September 2021 Patch Tuesday update cycle and addresses the CLFS driver privilege escalation flaw.
- Verify that all affected Windows versions are updated to their patched builds, including: Windows 10 1507 (build 10.0.10240.19060+), Windows 10 1607 (build 10.0.14393.4651+), Windows 10 1809 (build 10.0.17763.2183+), Windows 10 1909 (build 10.0.18363.1801+), Windows 10 2004/20H2/21H1 (build 10.0.19041.1237+), Windows 7, Windows 8.1, Windows Server 2008/R2, Server 2012, Server 2016, Server 2019, and Server 2022.
- Given the ransomware association, prioritize network segmentation to isolate critical assets and ensure offline backups are current and tested. Implement application control policies to restrict unauthorized executables.
- Deploy endpoint detection and response (EDR) solutions capable of detecting CLFS driver exploitation patterns and privilege escalation attempts. Monitor for unusual SYSTEM-level process creation from user-context processes.
- Conduct proactive threat hunting on affected systems to determine if the vulnerability was exploited prior to patching. Look for indicators of ransomware deployment, lateral movement, and data exfiltration.
Technical Details
CVE-2021-36955 affects the Windows Common Log File System (CLFS) driver, a kernel-mode component responsible for managing high-performance transaction log files used by applications such as Active Directory, SQL Server, and the Windows Transaction Manager. The vulnerability allows a local attacker with low privileges to escalate to higher system privileges through exploitation of the CLFS driver's processing logic. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that the attack requires local access with low privileges, involves low complexity, and needs no user interaction. The scope is unchanged, meaning exploitation stays within the privilege boundary of the kernel driver, but since the CLFS driver operates in kernel mode, successful exploitation effectively grants SYSTEM-level privileges with complete control over the affected host.
Frequently Asked Questions
Is CVE-2021-36955 being actively exploited?
Yes. CVE-2021-36955 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Additionally, this vulnerability is known to be used in ransomware campaigns, and the EPSS score of 20.64% (95.5th percentile) indicates a very high exploitation probability.
What products are affected by CVE-2021-36955?
CVE-2021-36955 affects a wide range of Microsoft Windows versions including Windows 7, Windows 8.1, Windows RT 8.1, Windows 10 (versions 1507, 1607, 1809, 1909, 2004, 20H2, 21H1), Windows Server 2004, Server 2008/R2, Server 2012, Server 2016, Server 2019, Server 2022, and Server 20H2.
How do I fix CVE-2021-36955?
Apply the September 2021 Patch Tuesday updates from Microsoft immediately. Due to the ransomware association, also ensure offline backups are current, implement network segmentation, and deploy EDR solutions to monitor for exploitation attempts.
How severe is CVE-2021-36955?
CVE-2021-36955 has a CVSS 3.1 score of 7.8 (HIGH). Its association with ransomware campaigns and the very high EPSS score of 20.64% (95.5th percentile) make it a critical priority for remediation despite the HIGH rather than CRITICAL severity rating.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.