Local Privilege Escalation in Windows SAM (CVE‑2021‑36934) Enables SYSTEM Access via Shadow Copies
What It Is – A Windows local‑privilege‑escalation flaw (often called “HiveNightmare”) that lets any logged‑on user read the Security Account Manager (SAM) hive when a Volume Shadow Copy (VSS) of the system drive exists. Access to the SAM file permits credential dumping and elevation to SYSTEM rights.
Exploitability – Public proof‑of‑concept code and detailed write‑ups are available; the vulnerability is rated CVSS v3.1 7.8 (High). No authentication beyond a local account is required, making it trivial for an attacker who has already gained foothold on a machine.
Affected Products – Microsoft Windows 10 (1903‑2004), Windows Server 2016, Windows Server 2019, and Windows Server 2022 where VSS shadow copies are enabled and not properly protected.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous patch‑management evidence; unpatched hosts break the “maintain up‑to‑date software” control objective that maps to many frameworks (e.g., NIST CSF PR.IP‑12).
- Highlights a privileged‑access control gap: without proper segregation, a low‑privilege user can harvest SYSTEM credentials, undermining the “least‑privilege” assurance objective.
- Provides a concrete audit artifact (patch‑status, VSS configuration) that can be collected and presented in a Trust Center to prove due‑diligence to auditors and partners.
Recommended Actions
- Deploy Microsoft’s out‑of‑band patch (KB5004945 or later) across all Windows endpoints.
- Verify that VSS shadow copies of the system drive are either disabled or protected by restricting access to the SAM file.
- Run a fleet‑wide compliance scan to capture remediation evidence and map the fix to the “patch management” control objective.
- Update your privileged‑access policy to require MFA or secondary verification for any account that could access VSS.
Source: CISA KEV – CVE‑2021‑36934