Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited, publicly disclosed before the fix — Exploitation More Likely. Customer action: Required.
Details
When will Microsoft release a security update for this vulnerability?
Update: September 14, 2021 - We have completed the investigation and have released the September 2021 security updates to address this vulnerability. Please see the Security Updates table.
Update: September 14, 2021 - The September 2021 security updates are now available to address this vulnerability. Please see the Security Updates table for the versions of Windows that are affected.
Security updates
10.0.17763.2183 — https://support.microsoft.com/help/5005568
10.0.18363.1801 — https://support.microsoft.com/help/5005566
10.0.19043.1237 — https://support.microsoft.com/help/5005565
10.0.10240.19060 — https://support.microsoft.com/help/5005569
10.0.14393.4651 — https://support.microsoft.com/help/5005573
6.1.7601.25712 — https://support.microsoft.com/help/5005633
6.1.7601.25712 — https://support.microsoft.com/help/5005615
6.3.9600.20120 — https://support.microsoft.com/help/5005613
6.3.9600.20120 — https://support.microsoft.com/help/5005627
6.0.6003.21218 — https://support.microsoft.com/help/5005606
6.0.6003.21218 — https://support.microsoft.com/help/5005618
6.2.9200.23462 — https://support.microsoft.com/help/5005623
6.2.9200.23462 — https://support.microsoft.com/help/5005607
Vulnerabilities 1
-
High 7.8CVE-2021-36958 EPSS 31%
Windows Print Spooler Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could th…
Revision history
-
#2
CVE updated to announce that Microsoft is releasing the September 2021 security updates for all affected versions of Windows to address this vulnerability. Additionally, other information has been updated, including the following: 1) Executive Summary has been updated. 2) Workarounds have been removed as they are no longer applicable. 3) FAQs have been updated to reflect the release of the September 2021 security updates. 4) CVSS Vector String has been updated.
-
#1
Information published.
References
-
CVE-2021-36958 Windows Print Spooler Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36958
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss