PT-2021-3680 · Microsoft · Windows 10+1

Benjamin Delpy + 1 · Published 2021-07-20 · Updated 2026-06-16 · CVE-2021-36934

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 1809 through 21H1

Description An elevation of privilege vulnerability exists due to overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. This allows an attacker to run arbitrary code with SYSTEM privileges, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. The attacker must have the ability to execute code on a victim system to exploit this vulnerability. It is estimated that all versions of Windows 10 released in the last 2.5 years are affected.

Recommendations For Microsoft Windows versions 1809 through 21H1: Manually delete all shadow copies of system files, including the SAM database, after installing the security update to fully mitigate this vulnerability. Restrict access to the contents of %windir%system32config and delete all system restore points and shadow volumes that existed before access restrictions were put in place. As a temporary workaround, consider restricting access to the vulnerable system files until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2021-03913

CVE-2021-36934

Affected Products

Windows

Windows 10

References · 44

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/credentials/windows_sam_hivenightmare.rb · Exploit
• 🔥 https://github.com/GossiTheDog/HiveNightmare · Exploit
• 🔥 https://github.com/HuskyHacks/ShadowSteal · Exploit
• 🔥 https://github.com/WiredPulse/Invoke-HiveNightmare · Exploit
• 🔥 https://github.com/JoranSlingerland/CVE-2021-36934 · Exploit
• 🔥 https://github.com/romarroca/SeriousSam · Exploit
• 🔥 https://github.com/exploitblizzard/CVE-2021-36934 · Exploit
• 🔥 https://github.com/n3tsurge/CVE-2021-36934 · Exploit
• 🔥 https://github.com/Sp00p64/PyNightmare · Exploit
• 🔥 https://github.com/chron1k/oxide_hive · Exploit
• 🔥❌ https://github.com/cube0x0/CVE-2021-36934 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2021-36934 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/667346 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-36934 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934 · Vendor Advisory