{"schema_version":"2","view":"grouped","data":[{"id":55771,"cve_ids":["CVE-2026-96951"],"payload":{"kind":"advisory","title":"Microsoft Windows Command Injection Vulnerability","summary":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-96951","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-96951","aliases":["CVE-2026-96951"],"affected":[],"modified":"2026-10-13T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-77"],"cveID":"CVE-2026-96951","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951 ; BOD 26-04: BOD 26-04: Prioritizing Security Updates Based on Risk | CISA ; Forensics Triage Requirements: BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk | CISA ;  https://nvd.nist.gov/vuln/detail/CVE-2026-96951","dueDate":"2026-10-16","product":"Windows","dateAdded":"2026-10-13","vendorProject":"Microsoft","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.","vulnerabilityName":"Microsoft Windows Command Injection Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-96951","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:75f48784-ba00-4c81-9603-c5f8e0c3a2ae","priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2026-96951","metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"},"scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"products":[{"name":{"value":"Outlook.com","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1607","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1809","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 21H2","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 22H2","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 version 23H2","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 23H2","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 24H2","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 25H2","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 version 26H1","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 26H2","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2 (Server Core installation)","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016 (Server Core installation)","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019 (Server Core installation)","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2022","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2025","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2025 (Server Core installation)","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96951","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":2,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96951","advisory_id":"75f48784-ba00-4c81-9603-c5f8e0c3a2ae","event_types":["advisory"],"published_at":"2026-10-25T15:40:33.050393+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-13T00:00:00+00:00","detail_url":"/advisories/advisory%3A75f48784-ba00-4c81-9603-c5f8e0c3a2ae","group":{"id":"advisory:75f48784-ba00-4c81-9603-c5f8e0c3a2ae","revision":1,"primary_event_id":55300,"change":"published","superseded_by":[],"changed":{"id":55300,"cve_ids":["CVE-2026-96951"],"payload":{"kind":"advisory","title":"Microsoft Windows Command Injection Vulnerability","summary":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-96951","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-96951","aliases":["CVE-2026-96951"],"affected":[],"modified":"2026-10-13T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-77"],"cveID":"CVE-2026-96951","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951 ; BOD 26-04: BOD 26-04: Prioritizing Security Updates Based on Risk | CISA ; Forensics Triage Requirements: BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk | CISA ;  https://nvd.nist.gov/vuln/detail/CVE-2026-96951","dueDate":"2026-10-16","product":"Windows","dateAdded":"2026-10-13","vendorProject":"Microsoft","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.","vulnerabilityName":"Microsoft Windows Command Injection Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-96951","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:75f48784-ba00-4c81-9603-c5f8e0c3a2ae","priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2026-96951","metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"},"scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"products":[{"name":{"value":"Outlook.com","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1607","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1809","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 21H2","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 22H2","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 version 23H2","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 23H2","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 24H2","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 25H2","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 version 26H1","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 26H2","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2 (Server Core installation)","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016 (Server Core installation)","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019 (Server Core installation)","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2022","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2025","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2025 (Server Core installation)","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96951","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":2,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96951","advisory_id":"75f48784-ba00-4c81-9603-c5f8e0c3a2ae","event_types":["advisory"],"published_at":"2026-10-25T15:40:33.050393+00:00","technologies":["core-kev","windows"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-13T00:00:00+00:00","detail_url":"/events/55300"},"members":[{"id":55300,"cve_ids":["CVE-2026-96951"],"payload":{"kind":"advisory","title":"Microsoft Windows Command Injection Vulnerability","summary":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-96951","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-96951","aliases":["CVE-2026-96951"],"affected":[],"modified":"2026-10-13T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-77"],"cveID":"CVE-2026-96951","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951 ; BOD 26-04: BOD 26-04: Prioritizing Security Updates Based on Risk | CISA ; Forensics Triage Requirements: BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk | CISA ;  https://nvd.nist.gov/vuln/detail/CVE-2026-96951","dueDate":"2026-10-16","product":"Windows","dateAdded":"2026-10-13","vendorProject":"Microsoft","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.","vulnerabilityName":"Microsoft Windows Command Injection Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-96951","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:75f48784-ba00-4c81-9603-c5f8e0c3a2ae","priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2026-96951","metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"},"scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"products":[{"name":{"value":"Outlook.com","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1607","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1809","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 21H2","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 22H2","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 version 23H2","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 23H2","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 24H2","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 25H2","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 version 26H1","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 26H2","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2 (Server Core installation)","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016 (Server Core installation)","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019 (Server Core installation)","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2022","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2025","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2025 (Server Core installation)","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96951","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":2,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96951","advisory_id":"75f48784-ba00-4c81-9603-c5f8e0c3a2ae","event_types":["advisory"],"published_at":"2026-10-25T15:40:33.050393+00:00","technologies":["core-kev","windows"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-13T00:00:00+00:00","detail_url":"/events/55300"}]}},{"id":3652,"cve_ids":["CVE-2021-36955"],"payload":{"kind":"advisory","title":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-36955","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-36955","aliases":["CVE-2021-36955"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2021-36955","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36955","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-36955","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:56845987-e9c8-4179-b106-0a253fc84a84","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36955","advisory_id":"56845987-e9c8-4179-b106-0a253fc84a84","event_types":["advisory"],"published_at":"2026-10-24T21:39:27.041515+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A56845987-e9c8-4179-b106-0a253fc84a84","group":{"id":"advisory:56845987-e9c8-4179-b106-0a253fc84a84","revision":1,"primary_event_id":3669,"change":"published","superseded_by":[],"changed":{"id":3669,"cve_ids":["CVE-2021-36955"],"payload":{"kind":"advisory","title":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-36955","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-36955","aliases":["CVE-2021-36955"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2021-36955","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36955","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-36955","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:56845987-e9c8-4179-b106-0a253fc84a84","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36955","advisory_id":"56845987-e9c8-4179-b106-0a253fc84a84","event_types":["advisory"],"published_at":"2026-10-24T21:39:27.041515+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3669"},"members":[{"id":3669,"cve_ids":["CVE-2021-36955"],"payload":{"kind":"advisory","title":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-36955","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-36955","aliases":["CVE-2021-36955"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2021-36955","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36955","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-36955","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:56845987-e9c8-4179-b106-0a253fc84a84","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36955","advisory_id":"56845987-e9c8-4179-b106-0a253fc84a84","event_types":["advisory"],"published_at":"2026-10-24T21:39:27.041515+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3669"}]}},{"id":3651,"cve_ids":["CVE-2019-0863"],"payload":{"kind":"advisory","title":"Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability","summary":"Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2019-0863","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2019-0863","aliases":["CVE-2019-0863"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2019-0863","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0863","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode.","vulnerabilityName":"Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2019-0863","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:cdc22995-d654-41f3-8016-1d9b2a2accbb","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-0863","advisory_id":"cdc22995-d654-41f3-8016-1d9b2a2accbb","event_types":["advisory"],"published_at":"2026-10-24T21:39:26.266188+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3Acdc22995-d654-41f3-8016-1d9b2a2accbb","group":{"id":"advisory:cdc22995-d654-41f3-8016-1d9b2a2accbb","revision":1,"primary_event_id":3668,"change":"published","superseded_by":[],"changed":{"id":3668,"cve_ids":["CVE-2019-0863"],"payload":{"kind":"advisory","title":"Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability","summary":"Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2019-0863","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2019-0863","aliases":["CVE-2019-0863"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2019-0863","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0863","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode.","vulnerabilityName":"Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2019-0863","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:cdc22995-d654-41f3-8016-1d9b2a2accbb","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-0863","advisory_id":"cdc22995-d654-41f3-8016-1d9b2a2accbb","event_types":["advisory"],"published_at":"2026-10-24T21:39:26.266188+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3668"},"members":[{"id":3668,"cve_ids":["CVE-2019-0863"],"payload":{"kind":"advisory","title":"Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability","summary":"Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2019-0863","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2019-0863","aliases":["CVE-2019-0863"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2019-0863","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0863","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode.","vulnerabilityName":"Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2019-0863","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:cdc22995-d654-41f3-8016-1d9b2a2accbb","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-0863","advisory_id":"cdc22995-d654-41f3-8016-1d9b2a2accbb","event_types":["advisory"],"published_at":"2026-10-24T21:39:26.266188+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3668"}]}},{"id":3648,"cve_ids":["CVE-2019-1214"],"payload":{"kind":"advisory","title":"Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2019-1214","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2019-1214","aliases":["CVE-2019-1214"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2019-1214","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1214","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation.","vulnerabilityName":"Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2019-1214","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:411b55d8-1b17-4ce7-a61d-18c2422134a4","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1214","advisory_id":"411b55d8-1b17-4ce7-a61d-18c2422134a4","event_types":["advisory"],"published_at":"2026-10-24T21:39:23.981408+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A411b55d8-1b17-4ce7-a61d-18c2422134a4","group":{"id":"advisory:411b55d8-1b17-4ce7-a61d-18c2422134a4","revision":1,"primary_event_id":3665,"change":"published","superseded_by":[],"changed":{"id":3665,"cve_ids":["CVE-2019-1214"],"payload":{"kind":"advisory","title":"Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2019-1214","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2019-1214","aliases":["CVE-2019-1214"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2019-1214","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1214","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation.","vulnerabilityName":"Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2019-1214","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:411b55d8-1b17-4ce7-a61d-18c2422134a4","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1214","advisory_id":"411b55d8-1b17-4ce7-a61d-18c2422134a4","event_types":["advisory"],"published_at":"2026-10-24T21:39:23.981408+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3665"},"members":[{"id":3665,"cve_ids":["CVE-2019-1214"],"payload":{"kind":"advisory","title":"Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability","summary":"Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2019-1214","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2019-1214","aliases":["CVE-2019-1214"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2019-1214","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1214","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation.","vulnerabilityName":"Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2019-1214","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:411b55d8-1b17-4ce7-a61d-18c2422134a4","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1214","advisory_id":"411b55d8-1b17-4ce7-a61d-18c2422134a4","event_types":["advisory"],"published_at":"2026-10-24T21:39:23.981408+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3665"}]}},{"id":3643,"cve_ids":["CVE-2020-0601"],"payload":{"kind":"advisory","title":"Microsoft Windows CryptoAPI Spoofing Vulnerability","summary":"Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0601","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0601","aliases":["CVE-2020-0601"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-295"],"cveID":"CVE-2020-0601","notes":"Reference CISA's ED 20-02 (https://www.cisa.gov/news-events/directives/ed-20-02-mitigate-windows-vulnerabilities-january-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-02. https://nvd.nist.gov/vuln/detail/CVE-2020-0601","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.","vulnerabilityName":"Microsoft Windows CryptoAPI Spoofing Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-0601","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:dfee5fbc-57bf-4cfd-b7d7-476f4ec1aff4","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0601","advisory_id":"dfee5fbc-57bf-4cfd-b7d7-476f4ec1aff4","event_types":["advisory"],"published_at":"2026-10-24T21:39:19.22435+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3Adfee5fbc-57bf-4cfd-b7d7-476f4ec1aff4","group":{"id":"advisory:dfee5fbc-57bf-4cfd-b7d7-476f4ec1aff4","revision":1,"primary_event_id":3660,"change":"published","superseded_by":[],"changed":{"id":3660,"cve_ids":["CVE-2020-0601"],"payload":{"kind":"advisory","title":"Microsoft Windows CryptoAPI Spoofing Vulnerability","summary":"Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0601","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0601","aliases":["CVE-2020-0601"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-295"],"cveID":"CVE-2020-0601","notes":"Reference CISA's ED 20-02 (https://www.cisa.gov/news-events/directives/ed-20-02-mitigate-windows-vulnerabilities-january-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-02. https://nvd.nist.gov/vuln/detail/CVE-2020-0601","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.","vulnerabilityName":"Microsoft Windows CryptoAPI Spoofing Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-0601","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:dfee5fbc-57bf-4cfd-b7d7-476f4ec1aff4","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0601","advisory_id":"dfee5fbc-57bf-4cfd-b7d7-476f4ec1aff4","event_types":["advisory"],"published_at":"2026-10-24T21:39:19.22435+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3660"},"members":[{"id":3660,"cve_ids":["CVE-2020-0601"],"payload":{"kind":"advisory","title":"Microsoft Windows CryptoAPI Spoofing Vulnerability","summary":"Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0601","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0601","aliases":["CVE-2020-0601"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-295"],"cveID":"CVE-2020-0601","notes":"Reference CISA's ED 20-02 (https://www.cisa.gov/news-events/directives/ed-20-02-mitigate-windows-vulnerabilities-january-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-02. https://nvd.nist.gov/vuln/detail/CVE-2020-0601","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.","vulnerabilityName":"Microsoft Windows CryptoAPI Spoofing Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-0601","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:dfee5fbc-57bf-4cfd-b7d7-476f4ec1aff4","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0601","advisory_id":"dfee5fbc-57bf-4cfd-b7d7-476f4ec1aff4","event_types":["advisory"],"published_at":"2026-10-24T21:39:19.22435+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3660"}]}},{"id":3642,"cve_ids":["CVE-2021-34448"],"payload":{"kind":"advisory","title":"Microsoft Windows Scripting Engine Memory Corruption Vulnerability","summary":"Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-34448","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-34448","aliases":["CVE-2021-34448"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2021-34448","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-34448","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption.","vulnerabilityName":"Microsoft Windows Scripting Engine Memory Corruption Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-34448","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1dcfdad7-91f2-4f52-8994-4ce6c4a22d89","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-34448","advisory_id":"1dcfdad7-91f2-4f52-8994-4ce6c4a22d89","event_types":["advisory"],"published_at":"2026-10-24T21:38:35.392432+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A1dcfdad7-91f2-4f52-8994-4ce6c4a22d89","group":{"id":"advisory:1dcfdad7-91f2-4f52-8994-4ce6c4a22d89","revision":1,"primary_event_id":3659,"change":"published","superseded_by":[],"changed":{"id":3659,"cve_ids":["CVE-2021-34448"],"payload":{"kind":"advisory","title":"Microsoft Windows Scripting Engine Memory Corruption Vulnerability","summary":"Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-34448","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-34448","aliases":["CVE-2021-34448"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2021-34448","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-34448","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption.","vulnerabilityName":"Microsoft Windows Scripting Engine Memory Corruption Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-34448","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1dcfdad7-91f2-4f52-8994-4ce6c4a22d89","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-34448","advisory_id":"1dcfdad7-91f2-4f52-8994-4ce6c4a22d89","event_types":["advisory"],"published_at":"2026-10-24T21:38:35.392432+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3659"},"members":[{"id":3659,"cve_ids":["CVE-2021-34448"],"payload":{"kind":"advisory","title":"Microsoft Windows Scripting Engine Memory Corruption Vulnerability","summary":"Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-34448","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-34448","aliases":["CVE-2021-34448"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2021-34448","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-34448","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption.","vulnerabilityName":"Microsoft Windows Scripting Engine Memory Corruption Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-34448","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1dcfdad7-91f2-4f52-8994-4ce6c4a22d89","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-34448","advisory_id":"1dcfdad7-91f2-4f52-8994-4ce6c4a22d89","event_types":["advisory"],"published_at":"2026-10-24T21:38:35.392432+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3659"}]}},{"id":3641,"cve_ids":["CVE-2021-1675"],"payload":{"kind":"advisory","title":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-1675","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-1675","aliases":["CVE-2021-1675"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-285"],"cveID":"CVE-2021-1675","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-1675","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.","vulnerabilityName":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-1675","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6d10788d-762f-45f1-b18d-4e7285c813b5","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-1675","advisory_id":"6d10788d-762f-45f1-b18d-4e7285c813b5","event_types":["advisory"],"published_at":"2026-10-24T21:38:34.761832+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A6d10788d-762f-45f1-b18d-4e7285c813b5","group":{"id":"advisory:6d10788d-762f-45f1-b18d-4e7285c813b5","revision":1,"primary_event_id":3658,"change":"published","superseded_by":[],"changed":{"id":3658,"cve_ids":["CVE-2021-1675"],"payload":{"kind":"advisory","title":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-1675","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-1675","aliases":["CVE-2021-1675"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-285"],"cveID":"CVE-2021-1675","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-1675","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.","vulnerabilityName":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-1675","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6d10788d-762f-45f1-b18d-4e7285c813b5","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-1675","advisory_id":"6d10788d-762f-45f1-b18d-4e7285c813b5","event_types":["advisory"],"published_at":"2026-10-24T21:38:34.761832+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3658"},"members":[{"id":3658,"cve_ids":["CVE-2021-1675"],"payload":{"kind":"advisory","title":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-1675","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-1675","aliases":["CVE-2021-1675"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-285"],"cveID":"CVE-2021-1675","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-1675","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.","vulnerabilityName":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-1675","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6d10788d-762f-45f1-b18d-4e7285c813b5","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-1675","advisory_id":"6d10788d-762f-45f1-b18d-4e7285c813b5","event_types":["advisory"],"published_at":"2026-10-24T21:38:34.761832+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3658"}]}},{"id":3620,"cve_ids":["CVE-2019-1215"],"payload":{"kind":"advisory","title":"Microsoft Windows Privilege Escalation Vulnerability","summary":"Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2019-1215","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2019-1215","aliases":["CVE-2019-1215"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2019-1215","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1215","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges.","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2019-1215","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e7fb48e9-d54b-4969-8397-52d18ee3f2e9","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1215","advisory_id":"e7fb48e9-d54b-4969-8397-52d18ee3f2e9","event_types":["advisory"],"published_at":"2026-10-24T21:38:22.199696+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3Ae7fb48e9-d54b-4969-8397-52d18ee3f2e9","group":{"id":"advisory:e7fb48e9-d54b-4969-8397-52d18ee3f2e9","revision":1,"primary_event_id":3637,"change":"published","superseded_by":[],"changed":{"id":3637,"cve_ids":["CVE-2019-1215"],"payload":{"kind":"advisory","title":"Microsoft Windows Privilege Escalation Vulnerability","summary":"Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2019-1215","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2019-1215","aliases":["CVE-2019-1215"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2019-1215","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1215","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges.","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2019-1215","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e7fb48e9-d54b-4969-8397-52d18ee3f2e9","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1215","advisory_id":"e7fb48e9-d54b-4969-8397-52d18ee3f2e9","event_types":["advisory"],"published_at":"2026-10-24T21:38:22.199696+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3637"},"members":[{"id":3637,"cve_ids":["CVE-2019-1215"],"payload":{"kind":"advisory","title":"Microsoft Windows Privilege Escalation Vulnerability","summary":"Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2019-1215","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2019-1215","aliases":["CVE-2019-1215"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2019-1215","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1215","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges.","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2019-1215","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e7fb48e9-d54b-4969-8397-52d18ee3f2e9","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1215","advisory_id":"e7fb48e9-d54b-4969-8397-52d18ee3f2e9","event_types":["advisory"],"published_at":"2026-10-24T21:38:22.199696+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3637"}]}},{"id":3618,"cve_ids":["CVE-2021-36942"],"payload":{"kind":"advisory","title":"Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability","summary":"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-36942","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-36942","aliases":["CVE-2021-36942"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-749"],"cveID":"CVE-2021-36942","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36942","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.","vulnerabilityName":"Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-36942","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d44eef24-e5ba-4b21-897a-6af5cb8046c6","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36942","advisory_id":"d44eef24-e5ba-4b21-897a-6af5cb8046c6","event_types":["advisory"],"published_at":"2026-10-24T21:38:21.035228+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3Ad44eef24-e5ba-4b21-897a-6af5cb8046c6","group":{"id":"advisory:d44eef24-e5ba-4b21-897a-6af5cb8046c6","revision":1,"primary_event_id":3635,"change":"published","superseded_by":[],"changed":{"id":3635,"cve_ids":["CVE-2021-36942"],"payload":{"kind":"advisory","title":"Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability","summary":"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-36942","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-36942","aliases":["CVE-2021-36942"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-749"],"cveID":"CVE-2021-36942","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36942","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.","vulnerabilityName":"Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-36942","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d44eef24-e5ba-4b21-897a-6af5cb8046c6","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36942","advisory_id":"d44eef24-e5ba-4b21-897a-6af5cb8046c6","event_types":["advisory"],"published_at":"2026-10-24T21:38:21.035228+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3635"},"members":[{"id":3635,"cve_ids":["CVE-2021-36942"],"payload":{"kind":"advisory","title":"Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability","summary":"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-36942","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-36942","aliases":["CVE-2021-36942"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-749"],"cveID":"CVE-2021-36942","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36942","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.","vulnerabilityName":"Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-36942","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d44eef24-e5ba-4b21-897a-6af5cb8046c6","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36942","advisory_id":"d44eef24-e5ba-4b21-897a-6af5cb8046c6","event_types":["advisory"],"published_at":"2026-10-24T21:38:21.035228+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3635"}]}},{"id":3611,"cve_ids":["CVE-2020-1350"],"payload":{"kind":"advisory","title":"Microsoft Windows DNS Server Remote Code Execution Vulnerability","summary":"Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-1350","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-1350","aliases":["CVE-2020-1350"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2020-1350","notes":"Reference CISA's ED 20-03 (https://www.cisa.gov/news-events/directives/ed-20-03-mitigate-windows-dns-server-remote-code-execution-vulnerability-july-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-03. https://nvd.nist.gov/vuln/detail/CVE-2020-1350","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.","vulnerabilityName":"Microsoft Windows DNS Server Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-1350","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b5b9e935-13c4-4731-9d51-79ba4fe46185","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1350","advisory_id":"b5b9e935-13c4-4731-9d51-79ba4fe46185","event_types":["advisory"],"published_at":"2026-10-24T21:38:16.623203+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3Ab5b9e935-13c4-4731-9d51-79ba4fe46185","group":{"id":"advisory:b5b9e935-13c4-4731-9d51-79ba4fe46185","revision":1,"primary_event_id":3628,"change":"published","superseded_by":[],"changed":{"id":3628,"cve_ids":["CVE-2020-1350"],"payload":{"kind":"advisory","title":"Microsoft Windows DNS Server Remote Code Execution Vulnerability","summary":"Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-1350","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-1350","aliases":["CVE-2020-1350"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2020-1350","notes":"Reference CISA's ED 20-03 (https://www.cisa.gov/news-events/directives/ed-20-03-mitigate-windows-dns-server-remote-code-execution-vulnerability-july-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-03. https://nvd.nist.gov/vuln/detail/CVE-2020-1350","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.","vulnerabilityName":"Microsoft Windows DNS Server Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-1350","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b5b9e935-13c4-4731-9d51-79ba4fe46185","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1350","advisory_id":"b5b9e935-13c4-4731-9d51-79ba4fe46185","event_types":["advisory"],"published_at":"2026-10-24T21:38:16.623203+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3628"},"members":[{"id":3628,"cve_ids":["CVE-2020-1350"],"payload":{"kind":"advisory","title":"Microsoft Windows DNS Server Remote Code Execution Vulnerability","summary":"Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-1350","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-1350","aliases":["CVE-2020-1350"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2020-1350","notes":"Reference CISA's ED 20-03 (https://www.cisa.gov/news-events/directives/ed-20-03-mitigate-windows-dns-server-remote-code-execution-vulnerability-july-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-03. https://nvd.nist.gov/vuln/detail/CVE-2020-1350","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.","vulnerabilityName":"Microsoft Windows DNS Server Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-1350","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b5b9e935-13c4-4731-9d51-79ba4fe46185","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1350","advisory_id":"b5b9e935-13c4-4731-9d51-79ba4fe46185","event_types":["advisory"],"published_at":"2026-10-24T21:38:16.623203+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3628"}]}},{"id":3607,"cve_ids":["CVE-2021-34527"],"payload":{"kind":"advisory","title":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-34527","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-34527","aliases":["CVE-2021-34527"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-269"],"cveID":"CVE-2021-34527","notes":"Reference CISA's ED 21-04 (https://www.cisa.gov/news-events/directives/ed-21-04-mitigate-windows-print-spooler-service-vulnerability) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-04. https://nvd.nist.gov/vuln/detail/CVE-2021-34527","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.","vulnerabilityName":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-34527","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:58e247be-7d55-490c-a1e5-01fe738c79c9","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-34527","advisory_id":"58e247be-7d55-490c-a1e5-01fe738c79c9","event_types":["advisory"],"published_at":"2026-10-24T21:38:13.938908+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A58e247be-7d55-490c-a1e5-01fe738c79c9","group":{"id":"advisory:58e247be-7d55-490c-a1e5-01fe738c79c9","revision":1,"primary_event_id":3624,"change":"published","superseded_by":[],"changed":{"id":3624,"cve_ids":["CVE-2021-34527"],"payload":{"kind":"advisory","title":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-34527","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-34527","aliases":["CVE-2021-34527"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-269"],"cveID":"CVE-2021-34527","notes":"Reference CISA's ED 21-04 (https://www.cisa.gov/news-events/directives/ed-21-04-mitigate-windows-print-spooler-service-vulnerability) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-04. https://nvd.nist.gov/vuln/detail/CVE-2021-34527","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.","vulnerabilityName":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-34527","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:58e247be-7d55-490c-a1e5-01fe738c79c9","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-34527","advisory_id":"58e247be-7d55-490c-a1e5-01fe738c79c9","event_types":["advisory"],"published_at":"2026-10-24T21:38:13.938908+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3624"},"members":[{"id":3624,"cve_ids":["CVE-2021-34527"],"payload":{"kind":"advisory","title":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","summary":"Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-34527","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-34527","aliases":["CVE-2021-34527"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-269"],"cveID":"CVE-2021-34527","notes":"Reference CISA's ED 21-04 (https://www.cisa.gov/news-events/directives/ed-21-04-mitigate-windows-print-spooler-service-vulnerability) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-04. https://nvd.nist.gov/vuln/detail/CVE-2021-34527","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.","vulnerabilityName":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-34527","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:58e247be-7d55-490c-a1e5-01fe738c79c9","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-34527","advisory_id":"58e247be-7d55-490c-a1e5-01fe738c79c9","event_types":["advisory"],"published_at":"2026-10-24T21:38:13.938908+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3624"}]}},{"id":3604,"cve_ids":["CVE-2020-1464"],"payload":{"kind":"advisory","title":"Microsoft Windows Spoofing Vulnerability","summary":"Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-1464","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-1464","aliases":["CVE-2020-1464"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-347"],"cveID":"CVE-2020-1464","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1464","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files.","vulnerabilityName":"Microsoft Windows Spoofing Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-1464","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3e6a8c50-4216-43bc-9716-bdb89133b8c5","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1464","advisory_id":"3e6a8c50-4216-43bc-9716-bdb89133b8c5","event_types":["advisory"],"published_at":"2026-10-24T21:38:12.202403+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A3e6a8c50-4216-43bc-9716-bdb89133b8c5","group":{"id":"advisory:3e6a8c50-4216-43bc-9716-bdb89133b8c5","revision":1,"primary_event_id":3621,"change":"published","superseded_by":[],"changed":{"id":3621,"cve_ids":["CVE-2020-1464"],"payload":{"kind":"advisory","title":"Microsoft Windows Spoofing Vulnerability","summary":"Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-1464","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-1464","aliases":["CVE-2020-1464"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-347"],"cveID":"CVE-2020-1464","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1464","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files.","vulnerabilityName":"Microsoft Windows Spoofing Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-1464","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3e6a8c50-4216-43bc-9716-bdb89133b8c5","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1464","advisory_id":"3e6a8c50-4216-43bc-9716-bdb89133b8c5","event_types":["advisory"],"published_at":"2026-10-24T21:38:12.202403+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3621"},"members":[{"id":3621,"cve_ids":["CVE-2020-1464"],"payload":{"kind":"advisory","title":"Microsoft Windows Spoofing Vulnerability","summary":"Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-1464","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-1464","aliases":["CVE-2020-1464"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-347"],"cveID":"CVE-2020-1464","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1464","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files.","vulnerabilityName":"Microsoft Windows Spoofing Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-1464","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3e6a8c50-4216-43bc-9716-bdb89133b8c5","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1464","advisory_id":"3e6a8c50-4216-43bc-9716-bdb89133b8c5","event_types":["advisory"],"published_at":"2026-10-24T21:38:12.202403+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3621"}]}},{"id":3603,"cve_ids":["CVE-2017-0143"],"payload":{"kind":"advisory","title":"Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability","summary":"Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2017-0143","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-0143","aliases":["CVE-2017-0143"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-20"],"cveID":"CVE-2017-0143","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0143","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.","vulnerabilityName":"Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2017-0143","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7af1efd9-6278-4731-b6e7-023d326e5a6d","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0143","advisory_id":"7af1efd9-6278-4731-b6e7-023d326e5a6d","event_types":["advisory"],"published_at":"2026-10-24T21:38:11.630153+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A7af1efd9-6278-4731-b6e7-023d326e5a6d","group":{"id":"advisory:7af1efd9-6278-4731-b6e7-023d326e5a6d","revision":1,"primary_event_id":3620,"change":"published","superseded_by":[],"changed":{"id":3620,"cve_ids":["CVE-2017-0143"],"payload":{"kind":"advisory","title":"Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability","summary":"Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2017-0143","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-0143","aliases":["CVE-2017-0143"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-20"],"cveID":"CVE-2017-0143","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0143","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.","vulnerabilityName":"Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2017-0143","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7af1efd9-6278-4731-b6e7-023d326e5a6d","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0143","advisory_id":"7af1efd9-6278-4731-b6e7-023d326e5a6d","event_types":["advisory"],"published_at":"2026-10-24T21:38:11.630153+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3620"},"members":[{"id":3620,"cve_ids":["CVE-2017-0143"],"payload":{"kind":"advisory","title":"Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability","summary":"Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2017-0143","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-0143","aliases":["CVE-2017-0143"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-20"],"cveID":"CVE-2017-0143","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0143","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.","vulnerabilityName":"Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2017-0143","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7af1efd9-6278-4731-b6e7-023d326e5a6d","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0143","advisory_id":"7af1efd9-6278-4731-b6e7-023d326e5a6d","event_types":["advisory"],"published_at":"2026-10-24T21:38:11.630153+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3620"}]}},{"id":3598,"cve_ids":["CVE-2021-36948"],"payload":{"kind":"advisory","title":"Microsoft Windows Update Medic Service Privilege Escalation Vulnerability","summary":"Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-36948","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-36948","aliases":["CVE-2021-36948"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2021-36948","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36948","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Update Medic Service Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-36948","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:83f01600-c39a-40ee-8f19-2feab7c484a2","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36948","advisory_id":"83f01600-c39a-40ee-8f19-2feab7c484a2","event_types":["advisory"],"published_at":"2026-10-24T21:38:08.729871+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A83f01600-c39a-40ee-8f19-2feab7c484a2","group":{"id":"advisory:83f01600-c39a-40ee-8f19-2feab7c484a2","revision":1,"primary_event_id":3615,"change":"published","superseded_by":[],"changed":{"id":3615,"cve_ids":["CVE-2021-36948"],"payload":{"kind":"advisory","title":"Microsoft Windows Update Medic Service Privilege Escalation Vulnerability","summary":"Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-36948","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-36948","aliases":["CVE-2021-36948"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2021-36948","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36948","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Update Medic Service Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-36948","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:83f01600-c39a-40ee-8f19-2feab7c484a2","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36948","advisory_id":"83f01600-c39a-40ee-8f19-2feab7c484a2","event_types":["advisory"],"published_at":"2026-10-24T21:38:08.729871+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3615"},"members":[{"id":3615,"cve_ids":["CVE-2021-36948"],"payload":{"kind":"advisory","title":"Microsoft Windows Update Medic Service Privilege Escalation Vulnerability","summary":"Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-36948","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-36948","aliases":["CVE-2021-36948"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2021-36948","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36948","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Update Medic Service Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-36948","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:83f01600-c39a-40ee-8f19-2feab7c484a2","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-36948","advisory_id":"83f01600-c39a-40ee-8f19-2feab7c484a2","event_types":["advisory"],"published_at":"2026-10-24T21:38:08.729871+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3615"}]}},{"id":3595,"cve_ids":["CVE-2020-0986"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0986","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0986","aliases":["CVE-2020-0986"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2020-0986","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0986","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode.","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-0986","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:20eadac2-19f1-4604-96fe-32701517873d","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0986","advisory_id":"20eadac2-19f1-4604-96fe-32701517873d","event_types":["advisory"],"published_at":"2026-10-24T21:38:06.999967+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A20eadac2-19f1-4604-96fe-32701517873d","group":{"id":"advisory:20eadac2-19f1-4604-96fe-32701517873d","revision":1,"primary_event_id":3612,"change":"published","superseded_by":[],"changed":{"id":3612,"cve_ids":["CVE-2020-0986"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0986","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0986","aliases":["CVE-2020-0986"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2020-0986","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0986","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode.","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-0986","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:20eadac2-19f1-4604-96fe-32701517873d","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0986","advisory_id":"20eadac2-19f1-4604-96fe-32701517873d","event_types":["advisory"],"published_at":"2026-10-24T21:38:06.999967+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3612"},"members":[{"id":3612,"cve_ids":["CVE-2020-0986"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0986","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0986","aliases":["CVE-2020-0986"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2020-0986","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0986","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode.","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-0986","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:20eadac2-19f1-4604-96fe-32701517873d","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0986","advisory_id":"20eadac2-19f1-4604-96fe-32701517873d","event_types":["advisory"],"published_at":"2026-10-24T21:38:06.999967+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3612"}]}},{"id":3593,"cve_ids":["CVE-2020-1020"],"payload":{"kind":"advisory","title":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","summary":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-1020","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-1020","aliases":["CVE-2020-1020"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2020-1020","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1020","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.","vulnerabilityName":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-1020","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b924bdf9-9ac3-4cf4-b094-576a426ffac6","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1020","advisory_id":"b924bdf9-9ac3-4cf4-b094-576a426ffac6","event_types":["advisory"],"published_at":"2026-10-24T21:38:05.888191+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3Ab924bdf9-9ac3-4cf4-b094-576a426ffac6","group":{"id":"advisory:b924bdf9-9ac3-4cf4-b094-576a426ffac6","revision":1,"primary_event_id":3610,"change":"published","superseded_by":[],"changed":{"id":3610,"cve_ids":["CVE-2020-1020"],"payload":{"kind":"advisory","title":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","summary":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-1020","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-1020","aliases":["CVE-2020-1020"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2020-1020","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1020","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.","vulnerabilityName":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-1020","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b924bdf9-9ac3-4cf4-b094-576a426ffac6","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1020","advisory_id":"b924bdf9-9ac3-4cf4-b094-576a426ffac6","event_types":["advisory"],"published_at":"2026-10-24T21:38:05.888191+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3610"},"members":[{"id":3610,"cve_ids":["CVE-2020-1020"],"payload":{"kind":"advisory","title":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","summary":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-1020","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-1020","aliases":["CVE-2020-1020"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2020-1020","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1020","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.","vulnerabilityName":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-1020","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b924bdf9-9ac3-4cf4-b094-576a426ffac6","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1020","advisory_id":"b924bdf9-9ac3-4cf4-b094-576a426ffac6","event_types":["advisory"],"published_at":"2026-10-24T21:38:05.888191+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3610"}]}},{"id":3591,"cve_ids":["CVE-2020-0938"],"payload":{"kind":"advisory","title":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","summary":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0938","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0938","aliases":["CVE-2020-0938"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2020-0938","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0938","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.","vulnerabilityName":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-0938","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:593aa785-6af9-4326-a456-2a6ed3589018","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0938","advisory_id":"593aa785-6af9-4326-a456-2a6ed3589018","event_types":["advisory"],"published_at":"2026-10-24T21:38:04.699184+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A593aa785-6af9-4326-a456-2a6ed3589018","group":{"id":"advisory:593aa785-6af9-4326-a456-2a6ed3589018","revision":1,"primary_event_id":3608,"change":"published","superseded_by":[],"changed":{"id":3608,"cve_ids":["CVE-2020-0938"],"payload":{"kind":"advisory","title":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","summary":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0938","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0938","aliases":["CVE-2020-0938"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2020-0938","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0938","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.","vulnerabilityName":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-0938","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:593aa785-6af9-4326-a456-2a6ed3589018","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0938","advisory_id":"593aa785-6af9-4326-a456-2a6ed3589018","event_types":["advisory"],"published_at":"2026-10-24T21:38:04.699184+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3608"},"members":[{"id":3608,"cve_ids":["CVE-2020-0938"],"payload":{"kind":"advisory","title":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","summary":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0938","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0938","aliases":["CVE-2020-0938"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2020-0938","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0938","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.","vulnerabilityName":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-0938","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:593aa785-6af9-4326-a456-2a6ed3589018","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0938","advisory_id":"593aa785-6af9-4326-a456-2a6ed3589018","event_types":["advisory"],"published_at":"2026-10-24T21:38:04.699184+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3608"}]}},{"id":3590,"cve_ids":["CVE-2021-31979"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-31979","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-31979","aliases":["CVE-2021-31979"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-119"],"cveID":"CVE-2021-31979","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31979","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-31979","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:653292e8-96e6-4752-92f2-cfb8f898ee57","priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2021-31979","metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"},"scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"products":[{"name":{"value":"Windows 10 Version 1507","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1607","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1809","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1809","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1909","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 2004","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 20H2","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 21H1","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 7","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 7 Service Pack 1","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 8.1","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2008 R2 Service Pack 1","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2008 R2 Service Pack 1 (Server Core installation)","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2008 Service Pack 2","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2008 Service Pack 2 (Server Core installation)","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 (Server Core installation)","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2 (Server Core installation)","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016 (Server Core installation)","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019 (Server Core installation)","evidence":"/containers/cna/affected/22/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server version 2004","evidence":"/containers/cna/affected/23/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server version 20H2","evidence":"/containers/cna/affected/24/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-31979","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-31979","advisory_id":"653292e8-96e6-4752-92f2-cfb8f898ee57","event_types":["advisory"],"published_at":"2026-10-24T21:38:04.122082+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A653292e8-96e6-4752-92f2-cfb8f898ee57","group":{"id":"advisory:653292e8-96e6-4752-92f2-cfb8f898ee57","revision":1,"primary_event_id":3607,"change":"published","superseded_by":[],"changed":{"id":3607,"cve_ids":["CVE-2021-31979"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-31979","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-31979","aliases":["CVE-2021-31979"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-119"],"cveID":"CVE-2021-31979","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31979","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-31979","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:653292e8-96e6-4752-92f2-cfb8f898ee57","priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2021-31979","metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"},"scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"products":[{"name":{"value":"Windows 10 Version 1507","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1607","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1809","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1809","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1909","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 2004","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 20H2","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 21H1","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 7","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 7 Service Pack 1","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 8.1","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2008 R2 Service Pack 1","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2008 R2 Service Pack 1 (Server Core installation)","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2008 Service Pack 2","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2008 Service Pack 2 (Server Core installation)","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 (Server Core installation)","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2 (Server Core installation)","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016 (Server Core installation)","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019 (Server Core installation)","evidence":"/containers/cna/affected/22/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server version 2004","evidence":"/containers/cna/affected/23/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server version 20H2","evidence":"/containers/cna/affected/24/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-31979","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-31979","advisory_id":"653292e8-96e6-4752-92f2-cfb8f898ee57","event_types":["advisory"],"published_at":"2026-10-24T21:38:04.122082+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3607"},"members":[{"id":3607,"cve_ids":["CVE-2021-31979"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-31979","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-31979","aliases":["CVE-2021-31979"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-119"],"cveID":"CVE-2021-31979","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31979","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-31979","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:653292e8-96e6-4752-92f2-cfb8f898ee57","priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2021-31979","metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"},"scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"products":[{"name":{"value":"Windows 10 Version 1507","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1607","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1809","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1809","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1909","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 2004","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 20H2","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 21H1","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 7","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 7 Service Pack 1","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 8.1","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2008 R2 Service Pack 1","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2008 R2 Service Pack 1 (Server Core installation)","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2008 Service Pack 2","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2008 Service Pack 2 (Server Core installation)","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 (Server Core installation)","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2 (Server Core installation)","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016 (Server Core installation)","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019 (Server Core installation)","evidence":"/containers/cna/affected/22/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server version 2004","evidence":"/containers/cna/affected/23/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server version 20H2","evidence":"/containers/cna/affected/24/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-31979","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-31979","advisory_id":"653292e8-96e6-4752-92f2-cfb8f898ee57","event_types":["advisory"],"published_at":"2026-10-24T21:38:04.122082+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3607"}]}},{"id":3588,"cve_ids":["CVE-2021-31956"],"payload":{"kind":"advisory","title":"Microsoft Windows NTFS Privilege Escalation Vulnerability","summary":"Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-31956","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-31956","aliases":["CVE-2021-31956"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-191","CWE-787"],"cveID":"CVE-2021-31956","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31956","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application.","vulnerabilityName":"Microsoft Windows NTFS Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-31956","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fe30fea6-ca36-4b25-b021-5b6a37ecfc2c","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-31956","advisory_id":"fe30fea6-ca36-4b25-b021-5b6a37ecfc2c","event_types":["advisory"],"published_at":"2026-10-24T21:38:02.789937+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3Afe30fea6-ca36-4b25-b021-5b6a37ecfc2c","group":{"id":"advisory:fe30fea6-ca36-4b25-b021-5b6a37ecfc2c","revision":1,"primary_event_id":3605,"change":"published","superseded_by":[],"changed":{"id":3605,"cve_ids":["CVE-2021-31956"],"payload":{"kind":"advisory","title":"Microsoft Windows NTFS Privilege Escalation Vulnerability","summary":"Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-31956","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-31956","aliases":["CVE-2021-31956"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-191","CWE-787"],"cveID":"CVE-2021-31956","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31956","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application.","vulnerabilityName":"Microsoft Windows NTFS Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-31956","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fe30fea6-ca36-4b25-b021-5b6a37ecfc2c","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-31956","advisory_id":"fe30fea6-ca36-4b25-b021-5b6a37ecfc2c","event_types":["advisory"],"published_at":"2026-10-24T21:38:02.789937+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3605"},"members":[{"id":3605,"cve_ids":["CVE-2021-31956"],"payload":{"kind":"advisory","title":"Microsoft Windows NTFS Privilege Escalation Vulnerability","summary":"Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-31956","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-31956","aliases":["CVE-2021-31956"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-191","CWE-787"],"cveID":"CVE-2021-31956","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31956","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application.","vulnerabilityName":"Microsoft Windows NTFS Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-31956","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fe30fea6-ca36-4b25-b021-5b6a37ecfc2c","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-31956","advisory_id":"fe30fea6-ca36-4b25-b021-5b6a37ecfc2c","event_types":["advisory"],"published_at":"2026-10-24T21:38:02.789937+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3605"}]}},{"id":3587,"cve_ids":["CVE-2021-33771"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-33771","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-33771","aliases":["CVE-2021-33771"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-119"],"cveID":"CVE-2021-33771","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-33771","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-33771","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0e41fa94-f010-4383-9b13-1f68684626a2","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-33771","advisory_id":"0e41fa94-f010-4383-9b13-1f68684626a2","event_types":["advisory"],"published_at":"2026-10-24T21:38:02.192818+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A0e41fa94-f010-4383-9b13-1f68684626a2","group":{"id":"advisory:0e41fa94-f010-4383-9b13-1f68684626a2","revision":1,"primary_event_id":3604,"change":"published","superseded_by":[],"changed":{"id":3604,"cve_ids":["CVE-2021-33771"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-33771","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-33771","aliases":["CVE-2021-33771"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-119"],"cveID":"CVE-2021-33771","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-33771","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-33771","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0e41fa94-f010-4383-9b13-1f68684626a2","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-33771","advisory_id":"0e41fa94-f010-4383-9b13-1f68684626a2","event_types":["advisory"],"published_at":"2026-10-24T21:38:02.192818+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3604"},"members":[{"id":3604,"cve_ids":["CVE-2021-33771"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-33771","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-33771","aliases":["CVE-2021-33771"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-119"],"cveID":"CVE-2021-33771","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-33771","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-33771","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0e41fa94-f010-4383-9b13-1f68684626a2","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-33771","advisory_id":"0e41fa94-f010-4383-9b13-1f68684626a2","event_types":["advisory"],"published_at":"2026-10-24T21:38:02.192818+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3604"}]}},{"id":3585,"cve_ids":["CVE-2020-0683"],"payload":{"kind":"advisory","title":"Microsoft Windows Installer Privilege Escalation Vulnerability","summary":"Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0683","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0683","aliases":["CVE-2020-0683"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2020-0683","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0683","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files.","vulnerabilityName":"Microsoft Windows Installer Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-0683","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:43e7d473-197f-4ed7-97ea-66105d7c02f8","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0683","advisory_id":"43e7d473-197f-4ed7-97ea-66105d7c02f8","event_types":["advisory"],"published_at":"2026-10-24T21:38:00.874846+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A43e7d473-197f-4ed7-97ea-66105d7c02f8","group":{"id":"advisory:43e7d473-197f-4ed7-97ea-66105d7c02f8","revision":1,"primary_event_id":3602,"change":"published","superseded_by":[],"changed":{"id":3602,"cve_ids":["CVE-2020-0683"],"payload":{"kind":"advisory","title":"Microsoft Windows Installer Privilege Escalation Vulnerability","summary":"Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0683","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0683","aliases":["CVE-2020-0683"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2020-0683","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0683","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files.","vulnerabilityName":"Microsoft Windows Installer Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-0683","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:43e7d473-197f-4ed7-97ea-66105d7c02f8","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0683","advisory_id":"43e7d473-197f-4ed7-97ea-66105d7c02f8","event_types":["advisory"],"published_at":"2026-10-24T21:38:00.874846+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3602"},"members":[{"id":3602,"cve_ids":["CVE-2020-0683"],"payload":{"kind":"advisory","title":"Microsoft Windows Installer Privilege Escalation Vulnerability","summary":"Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0683","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0683","aliases":["CVE-2020-0683"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2020-0683","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0683","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files.","vulnerabilityName":"Microsoft Windows Installer Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-0683","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:43e7d473-197f-4ed7-97ea-66105d7c02f8","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0683","advisory_id":"43e7d473-197f-4ed7-97ea-66105d7c02f8","event_types":["advisory"],"published_at":"2026-10-24T21:38:00.874846+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3602"}]}},{"id":3584,"cve_ids":["CVE-2020-17087"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-17087","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-17087","aliases":["CVE-2020-17087"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-131"],"cveID":"CVE-2020-17087","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-17087","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-17087","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:83211466-b58a-4c0b-97ba-f5d9af01c42a","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-17087","advisory_id":"83211466-b58a-4c0b-97ba-f5d9af01c42a","event_types":["advisory"],"published_at":"2026-10-24T21:38:00.251253+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A83211466-b58a-4c0b-97ba-f5d9af01c42a","group":{"id":"advisory:83211466-b58a-4c0b-97ba-f5d9af01c42a","revision":1,"primary_event_id":3601,"change":"published","superseded_by":[],"changed":{"id":3601,"cve_ids":["CVE-2020-17087"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-17087","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-17087","aliases":["CVE-2020-17087"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-131"],"cveID":"CVE-2020-17087","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-17087","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-17087","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:83211466-b58a-4c0b-97ba-f5d9af01c42a","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-17087","advisory_id":"83211466-b58a-4c0b-97ba-f5d9af01c42a","event_types":["advisory"],"published_at":"2026-10-24T21:38:00.251253+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3601"},"members":[{"id":3601,"cve_ids":["CVE-2020-17087"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Privilege Escalation Vulnerability","summary":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-17087","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-17087","aliases":["CVE-2020-17087"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-131"],"cveID":"CVE-2020-17087","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-17087","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-17087","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:83211466-b58a-4c0b-97ba-f5d9af01c42a","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-17087","advisory_id":"83211466-b58a-4c0b-97ba-f5d9af01c42a","event_types":["advisory"],"published_at":"2026-10-24T21:38:00.251253+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3601"}]}},{"id":3583,"cve_ids":["CVE-2021-33742"],"payload":{"kind":"advisory","title":"Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability","summary":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-33742","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-33742","aliases":["CVE-2021-33742"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787","CWE-823"],"cveID":"CVE-2021-33742","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-33742","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution.","vulnerabilityName":"Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-33742","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9bcd6a6d-29e1-444a-ab74-7c1ab705675b","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-33742","advisory_id":"9bcd6a6d-29e1-444a-ab74-7c1ab705675b","event_types":["advisory"],"published_at":"2026-10-24T21:37:59.416553+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A9bcd6a6d-29e1-444a-ab74-7c1ab705675b","group":{"id":"advisory:9bcd6a6d-29e1-444a-ab74-7c1ab705675b","revision":1,"primary_event_id":3600,"change":"published","superseded_by":[],"changed":{"id":3600,"cve_ids":["CVE-2021-33742"],"payload":{"kind":"advisory","title":"Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability","summary":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-33742","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-33742","aliases":["CVE-2021-33742"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787","CWE-823"],"cveID":"CVE-2021-33742","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-33742","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution.","vulnerabilityName":"Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-33742","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9bcd6a6d-29e1-444a-ab74-7c1ab705675b","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-33742","advisory_id":"9bcd6a6d-29e1-444a-ab74-7c1ab705675b","event_types":["advisory"],"published_at":"2026-10-24T21:37:59.416553+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3600"},"members":[{"id":3600,"cve_ids":["CVE-2021-33742"],"payload":{"kind":"advisory","title":"Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability","summary":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-33742","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-33742","aliases":["CVE-2021-33742"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787","CWE-823"],"cveID":"CVE-2021-33742","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-33742","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution.","vulnerabilityName":"Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-33742","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9bcd6a6d-29e1-444a-ab74-7c1ab705675b","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-33742","advisory_id":"9bcd6a6d-29e1-444a-ab74-7c1ab705675b","event_types":["advisory"],"published_at":"2026-10-24T21:37:59.416553+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3600"}]}},{"id":3582,"cve_ids":["CVE-2016-0185"],"payload":{"kind":"advisory","title":"Microsoft Windows Media Center Remote Code Execution Vulnerability","summary":"Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2016-0185","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2016-0185","aliases":["CVE-2016-0185"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-20"],"cveID":"CVE-2016-0185","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0185","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code.","vulnerabilityName":"Microsoft Windows Media Center Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2016-0185","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2cee61da-c78f-467b-a6b3-f4b2aafe5d68","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0185","advisory_id":"2cee61da-c78f-467b-a6b3-f4b2aafe5d68","event_types":["advisory"],"published_at":"2026-10-24T21:37:58.841938+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A2cee61da-c78f-467b-a6b3-f4b2aafe5d68","group":{"id":"advisory:2cee61da-c78f-467b-a6b3-f4b2aafe5d68","revision":1,"primary_event_id":3599,"change":"published","superseded_by":[],"changed":{"id":3599,"cve_ids":["CVE-2016-0185"],"payload":{"kind":"advisory","title":"Microsoft Windows Media Center Remote Code Execution Vulnerability","summary":"Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2016-0185","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2016-0185","aliases":["CVE-2016-0185"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-20"],"cveID":"CVE-2016-0185","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0185","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code.","vulnerabilityName":"Microsoft Windows Media Center Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2016-0185","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2cee61da-c78f-467b-a6b3-f4b2aafe5d68","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0185","advisory_id":"2cee61da-c78f-467b-a6b3-f4b2aafe5d68","event_types":["advisory"],"published_at":"2026-10-24T21:37:58.841938+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3599"},"members":[{"id":3599,"cve_ids":["CVE-2016-0185"],"payload":{"kind":"advisory","title":"Microsoft Windows Media Center Remote Code Execution Vulnerability","summary":"Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2016-0185","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2016-0185","aliases":["CVE-2016-0185"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-20"],"cveID":"CVE-2016-0185","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0185","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code.","vulnerabilityName":"Microsoft Windows Media Center Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2016-0185","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2cee61da-c78f-467b-a6b3-f4b2aafe5d68","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-0185","advisory_id":"2cee61da-c78f-467b-a6b3-f4b2aafe5d68","event_types":["advisory"],"published_at":"2026-10-24T21:37:58.841938+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3599"}]}},{"id":3580,"cve_ids":["CVE-2021-33739"],"payload":{"kind":"advisory","title":"Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability","summary":"Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-33739","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-33739","aliases":["CVE-2021-33739"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2021-33739","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-33739","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-33739","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8676ac71-c26c-467e-8400-9ae18c98ddd5","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-33739","advisory_id":"8676ac71-c26c-467e-8400-9ae18c98ddd5","event_types":["advisory"],"published_at":"2026-10-24T21:37:57.724452+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A8676ac71-c26c-467e-8400-9ae18c98ddd5","group":{"id":"advisory:8676ac71-c26c-467e-8400-9ae18c98ddd5","revision":1,"primary_event_id":3597,"change":"published","superseded_by":[],"changed":{"id":3597,"cve_ids":["CVE-2021-33739"],"payload":{"kind":"advisory","title":"Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability","summary":"Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-33739","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-33739","aliases":["CVE-2021-33739"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2021-33739","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-33739","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-33739","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8676ac71-c26c-467e-8400-9ae18c98ddd5","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-33739","advisory_id":"8676ac71-c26c-467e-8400-9ae18c98ddd5","event_types":["advisory"],"published_at":"2026-10-24T21:37:57.724452+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3597"},"members":[{"id":3597,"cve_ids":["CVE-2021-33739"],"payload":{"kind":"advisory","title":"Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability","summary":"Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-33739","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-33739","aliases":["CVE-2021-33739"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2021-33739","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-33739","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.","vulnerabilityName":"Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-33739","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8676ac71-c26c-467e-8400-9ae18c98ddd5","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-33739","advisory_id":"8676ac71-c26c-467e-8400-9ae18c98ddd5","event_types":["advisory"],"published_at":"2026-10-24T21:37:57.724452+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3597"}]}},{"id":3578,"cve_ids":["CVE-2021-31955"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Information Disclosure Vulnerability","summary":"Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-31955","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-31955","aliases":["CVE-2021-31955"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-497"],"cveID":"CVE-2021-31955","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31955","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process.","vulnerabilityName":"Microsoft Windows Kernel Information Disclosure Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-31955","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7e29761b-8355-4374-ada2-1ad35a407f49","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-31955","advisory_id":"7e29761b-8355-4374-ada2-1ad35a407f49","event_types":["advisory"],"published_at":"2026-10-24T21:37:56.593551+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A7e29761b-8355-4374-ada2-1ad35a407f49","group":{"id":"advisory:7e29761b-8355-4374-ada2-1ad35a407f49","revision":1,"primary_event_id":3595,"change":"published","superseded_by":[],"changed":{"id":3595,"cve_ids":["CVE-2021-31955"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Information Disclosure Vulnerability","summary":"Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-31955","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-31955","aliases":["CVE-2021-31955"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-497"],"cveID":"CVE-2021-31955","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31955","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process.","vulnerabilityName":"Microsoft Windows Kernel Information Disclosure Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-31955","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7e29761b-8355-4374-ada2-1ad35a407f49","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-31955","advisory_id":"7e29761b-8355-4374-ada2-1ad35a407f49","event_types":["advisory"],"published_at":"2026-10-24T21:37:56.593551+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3595"},"members":[{"id":3595,"cve_ids":["CVE-2021-31955"],"payload":{"kind":"advisory","title":"Microsoft Windows Kernel Information Disclosure Vulnerability","summary":"Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-31955","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-31955","aliases":["CVE-2021-31955"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-497"],"cveID":"CVE-2021-31955","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31955","dueDate":"2021-11-17","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process.","vulnerabilityName":"Microsoft Windows Kernel Information Disclosure Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-31955","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7e29761b-8355-4374-ada2-1ad35a407f49","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-31955","advisory_id":"7e29761b-8355-4374-ada2-1ad35a407f49","event_types":["advisory"],"published_at":"2026-10-24T21:37:56.593551+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3595"}]}},{"id":3576,"cve_ids":["CVE-2014-1812"],"payload":{"kind":"advisory","title":"Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability","summary":"Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2014-1812","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2014-1812","aliases":["CVE-2014-1812"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-255"],"cveID":"CVE-2014-1812","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-1812","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain.","vulnerabilityName":"Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2014-1812","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8347a718-db8e-4766-b2e0-ac0ca5f49f19","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-1812","advisory_id":"8347a718-db8e-4766-b2e0-ac0ca5f49f19","event_types":["advisory"],"published_at":"2026-10-24T21:37:55.441713+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/advisories/advisory%3A8347a718-db8e-4766-b2e0-ac0ca5f49f19","group":{"id":"advisory:8347a718-db8e-4766-b2e0-ac0ca5f49f19","revision":1,"primary_event_id":3593,"change":"published","superseded_by":[],"changed":{"id":3593,"cve_ids":["CVE-2014-1812"],"payload":{"kind":"advisory","title":"Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability","summary":"Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2014-1812","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2014-1812","aliases":["CVE-2014-1812"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-255"],"cveID":"CVE-2014-1812","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-1812","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain.","vulnerabilityName":"Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2014-1812","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8347a718-db8e-4766-b2e0-ac0ca5f49f19","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-1812","advisory_id":"8347a718-db8e-4766-b2e0-ac0ca5f49f19","event_types":["advisory"],"published_at":"2026-10-24T21:37:55.441713+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3593"},"members":[{"id":3593,"cve_ids":["CVE-2014-1812"],"payload":{"kind":"advisory","title":"Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability","summary":"Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2014-1812","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2014-1812","aliases":["CVE-2014-1812"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-255"],"cveID":"CVE-2014-1812","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-1812","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain.","vulnerabilityName":"Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2014-1812","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8347a718-db8e-4766-b2e0-ac0ca5f49f19","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-1812","advisory_id":"8347a718-db8e-4766-b2e0-ac0ca5f49f19","event_types":["advisory"],"published_at":"2026-10-24T21:37:55.441713+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-03T00:00:00+00:00","detail_url":"/events/3593"}]}},{"id":2962,"cve_ids":["CVE-2021-40449"],"payload":{"kind":"advisory","title":"Microsoft Windows Win32k Privilege Escalation Vulnerability","summary":"Unspecified vulnerability allows for an authenticated user to escalate privileges. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-40449","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-40449","aliases":["CVE-2021-40449"],"affected":[],"modified":"2021-11-17T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-416"],"cveID":"CVE-2021-40449","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-40449","dueDate":"2021-12-01","product":"Windows","dateAdded":"2021-11-17","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Unspecified vulnerability allows for an authenticated user to escalate privileges.","vulnerabilityName":"Microsoft Windows Win32k Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-40449","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b837d3d5-0b76-4241-ab7b-54ceb1f4a196","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40449","advisory_id":"b837d3d5-0b76-4241-ab7b-54ceb1f4a196","event_types":["advisory"],"published_at":"2026-10-24T21:26:55.752621+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-17T00:00:00+00:00","detail_url":"/advisories/advisory%3Ab837d3d5-0b76-4241-ab7b-54ceb1f4a196","group":{"id":"advisory:b837d3d5-0b76-4241-ab7b-54ceb1f4a196","revision":1,"primary_event_id":2966,"change":"published","superseded_by":[],"changed":{"id":2966,"cve_ids":["CVE-2021-40449"],"payload":{"kind":"advisory","title":"Microsoft Windows Win32k Privilege Escalation Vulnerability","summary":"Unspecified vulnerability allows for an authenticated user to escalate privileges. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-40449","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-40449","aliases":["CVE-2021-40449"],"affected":[],"modified":"2021-11-17T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-416"],"cveID":"CVE-2021-40449","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-40449","dueDate":"2021-12-01","product":"Windows","dateAdded":"2021-11-17","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Unspecified vulnerability allows for an authenticated user to escalate privileges.","vulnerabilityName":"Microsoft Windows Win32k Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-40449","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b837d3d5-0b76-4241-ab7b-54ceb1f4a196","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40449","advisory_id":"b837d3d5-0b76-4241-ab7b-54ceb1f4a196","event_types":["advisory"],"published_at":"2026-10-24T21:26:55.752621+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-17T00:00:00+00:00","detail_url":"/events/2966"},"members":[{"id":2966,"cve_ids":["CVE-2021-40449"],"payload":{"kind":"advisory","title":"Microsoft Windows Win32k Privilege Escalation Vulnerability","summary":"Unspecified vulnerability allows for an authenticated user to escalate privileges. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-40449","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-40449","aliases":["CVE-2021-40449"],"affected":[],"modified":"2021-11-17T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-416"],"cveID":"CVE-2021-40449","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-40449","dueDate":"2021-12-01","product":"Windows","dateAdded":"2021-11-17","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Unspecified vulnerability allows for an authenticated user to escalate privileges.","vulnerabilityName":"Microsoft Windows Win32k Privilege Escalation Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-40449","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b837d3d5-0b76-4241-ab7b-54ceb1f4a196","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40449","advisory_id":"b837d3d5-0b76-4241-ab7b-54ceb1f4a196","event_types":["advisory"],"published_at":"2026-10-24T21:26:55.752621+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-11-17T00:00:00+00:00","detail_url":"/events/2966"}]}},{"id":2940,"cve_ids":["CVE-2021-43890"],"payload":{"kind":"advisory","title":"Microsoft Windows AppX Installer Spoofing Vulnerability","summary":"Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-43890","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-43890","aliases":["CVE-2021-43890"],"affected":[],"modified":"2021-12-15T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2021-43890","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-43890","dueDate":"2021-12-29","product":"Windows","dateAdded":"2021-12-15","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.","vulnerabilityName":"Microsoft Windows AppX Installer Spoofing Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-43890","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4e02ca5f-8904-4fdf-bf16-b46c029fb528","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-43890","advisory_id":"4e02ca5f-8904-4fdf-bf16-b46c029fb528","event_types":["advisory"],"published_at":"2026-10-24T21:26:43.143855+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-12-15T00:00:00+00:00","detail_url":"/advisories/advisory%3A4e02ca5f-8904-4fdf-bf16-b46c029fb528","group":{"id":"advisory:4e02ca5f-8904-4fdf-bf16-b46c029fb528","revision":1,"primary_event_id":2945,"change":"published","superseded_by":[],"changed":{"id":2945,"cve_ids":["CVE-2021-43890"],"payload":{"kind":"advisory","title":"Microsoft Windows AppX Installer Spoofing Vulnerability","summary":"Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-43890","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-43890","aliases":["CVE-2021-43890"],"affected":[],"modified":"2021-12-15T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2021-43890","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-43890","dueDate":"2021-12-29","product":"Windows","dateAdded":"2021-12-15","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.","vulnerabilityName":"Microsoft Windows AppX Installer Spoofing Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-43890","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4e02ca5f-8904-4fdf-bf16-b46c029fb528","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-43890","advisory_id":"4e02ca5f-8904-4fdf-bf16-b46c029fb528","event_types":["advisory"],"published_at":"2026-10-24T21:26:43.143855+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-12-15T00:00:00+00:00","detail_url":"/events/2945"},"members":[{"id":2945,"cve_ids":["CVE-2021-43890"],"payload":{"kind":"advisory","title":"Microsoft Windows AppX Installer Spoofing Vulnerability","summary":"Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-43890","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-43890","aliases":["CVE-2021-43890"],"affected":[],"modified":"2021-12-15T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2021-43890","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-43890","dueDate":"2021-12-29","product":"Windows","dateAdded":"2021-12-15","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.","vulnerabilityName":"Microsoft Windows AppX Installer Spoofing Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-43890","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4e02ca5f-8904-4fdf-bf16-b46c029fb528","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-43890","advisory_id":"4e02ca5f-8904-4fdf-bf16-b46c029fb528","event_types":["advisory"],"published_at":"2026-10-24T21:26:43.143855+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-12-15T00:00:00+00:00","detail_url":"/events/2945"}]}},{"id":2903,"cve_ids":["CVE-2020-0787"],"payload":{"kind":"advisory","title":"Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability","summary":"Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0787","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0787","aliases":["CVE-2020-0787"],"affected":[],"modified":"2022-01-28T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-269","CWE-59"],"cveID":"CVE-2020-0787","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0787","dueDate":"2022-07-28","product":"Windows","dateAdded":"2022-01-28","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.","vulnerabilityName":"Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2020-0787","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9feb7ffc-705c-4f7d-912b-c2b126558d01","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0787","advisory_id":"9feb7ffc-705c-4f7d-912b-c2b126558d01","event_types":["advisory"],"published_at":"2026-10-24T21:26:20.427213+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-01-28T00:00:00+00:00","detail_url":"/advisories/advisory%3A9feb7ffc-705c-4f7d-912b-c2b126558d01","group":{"id":"advisory:9feb7ffc-705c-4f7d-912b-c2b126558d01","revision":1,"primary_event_id":2908,"change":"published","superseded_by":[],"changed":{"id":2908,"cve_ids":["CVE-2020-0787"],"payload":{"kind":"advisory","title":"Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability","summary":"Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0787","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0787","aliases":["CVE-2020-0787"],"affected":[],"modified":"2022-01-28T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-269","CWE-59"],"cveID":"CVE-2020-0787","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0787","dueDate":"2022-07-28","product":"Windows","dateAdded":"2022-01-28","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.","vulnerabilityName":"Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2020-0787","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9feb7ffc-705c-4f7d-912b-c2b126558d01","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0787","advisory_id":"9feb7ffc-705c-4f7d-912b-c2b126558d01","event_types":["advisory"],"published_at":"2026-10-24T21:26:20.427213+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-01-28T00:00:00+00:00","detail_url":"/events/2908"},"members":[{"id":2908,"cve_ids":["CVE-2020-0787"],"payload":{"kind":"advisory","title":"Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability","summary":"Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-0787","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-0787","aliases":["CVE-2020-0787"],"affected":[],"modified":"2022-01-28T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-269","CWE-59"],"cveID":"CVE-2020-0787","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0787","dueDate":"2022-07-28","product":"Windows","dateAdded":"2022-01-28","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.","vulnerabilityName":"Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2020-0787","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9feb7ffc-705c-4f7d-912b-c2b126558d01","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-0787","advisory_id":"9feb7ffc-705c-4f7d-912b-c2b126558d01","event_types":["advisory"],"published_at":"2026-10-24T21:26:20.427213+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-01-28T00:00:00+00:00","detail_url":"/events/2908"}]}}],"next_after":55771,"next_before":2903}