CVE-2021-36934

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2021-36934 is an elevation-of-privilege vulnerability in Windows caused by overly permissive Access Control Lists on multiple system files, including the Security Accounts Manager (SAM) database. Successful exploitation allows an attacker to run arbitrary code with SYSTEM-level privileges on the affected system.

An attacker must already be able to execute code on the victim machine. Once exploited, the attacker can install programs, view or modify data, delete files, and create new accounts with full administrative rights. The CVSS 3.1 base score is 7.8 with a local attack vector, low attack complexity, and low privileges required.

Microsoft’s advisory states that the security update alone does not fully remediate the issue; administrators must also manually delete all Volume Shadow Copies of the affected system files, including the SAM database, as described in KB5005357. Public exploit code released under the names HiveNightmare and SeriousSAM demonstrates the flaw using standard user privileges to read sensitive registry hives from shadow copies.