Critical Remote Code Execution Vulnerability (CVE-2021-1675) in Microsoft Windows Print Spooler (PrintNightmare)
What It Is — Microsoft Windows Print Spooler contains an unspecified flaw that allows remote code execution without authentication. Known as PrintNightmare, it can let attackers execute arbitrary code with SYSTEM privileges.
Exploitability — Public exploits and proof‑of‑concept code have been released; the vulnerability is actively exploited in the wild. CVSS v3.1 base score 8.8 (High).
Affected Products — All supported Windows client and server operating systems that include the Print Spooler service (Windows 10, Windows Server 2016‑2022, etc.).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous patch‑management evidence to prove due‑diligence in audits.
- Highlights the importance of privileged‑service hardening and access‑control policies that limit who can start or modify system services.
- Provides a concrete test case for control monitoring: detecting unexpected service restarts or anomalous DLL loads can serve as audit‑ready alerts.
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2021‑1675 immediately across all Windows endpoints.
- Where printing is not required, disable the Print Spooler service and enforce a policy that only authorized accounts can start it.
- Enable advanced logging for Service Control Manager events and monitor for suspicious DLL load activity.
- Document patch deployment and service‑hardening steps in your control evidence repository.
Source: CISA KEV – CVE‑2021‑1675