CVE‑2021‑36942: Windows LSA Spoofing Vulnerability Enables NTLM Relay to Domain Controllers
What It Is – A spoofing flaw in the Windows Local Security Authority (LSA) lets an unauthenticated attacker call a method on the LSARPC interface and coerce a domain controller to authenticate against an attacker‑controlled server using NTLM.
Exploitability – Publicly disclosed with proof‑of‑concept code; CVSS v3.1 base score 8.8 (High). No widespread ransomware‑style exploitation reported, but the attack path is straightforward for skilled adversaries.
Affected Products – Microsoft Windows operating systems (Windows 10, Windows 11, Windows Server 2012 R2, 2016, 2019, 2022, and later).
Why It Matters for Trust & Control Assurance
- Continuous evidence of timely patch deployment is a core control objective; missing patches erode audit‑ready posture.
- Monitoring NTLM authentication flows provides defensible evidence that credential‑use policies are being enforced.
- Demonstrating that authentication mechanisms are protected against spoofing satisfies multiple framework controls (e.g., access‑control and logging) with a single assurance activity.
Recommended Actions
- Apply Microsoft’s security update for CVE‑2021‑36942 on all Windows endpoints and servers.
- Verify patch rollout with automated inventory/CMDB tools and retain evidence of compliance.
- Enable detection for anomalous NTLM authentication to non‑domain servers (e.g., via SIEM or endpoint telemetry).
- Where feasible, disable NTLM and enforce SMB signing to reduce the attack surface.
Source: CISA KEV – CVE‑2021‑36942