Privilege Escalation in Microsoft Windows Installer (CVE‑2021‑41379) Listed in CISA KEV
What It Is – Windows Installer contains an unspecified flaw that allows a low‑privileged user to gain elevated system rights. The vulnerability is tracked as CVE‑2021‑41379 and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
Exploitability – Publicly‑known exploit code exists; attackers can trigger the flaw by delivering a malicious MSI package. The CVSS 3.1 base score is 7.8 (High).
Affected Products – Microsoft Windows operating systems that include Windows Installer (all supported Windows 10 and Windows Server releases prior to the security update released March 2022).
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – The flaw bypasses the principle of least privilege, a core control objective for any organization that must demonstrate robust identity and access management.
- Continuous patch assurance – Inclusion in CISA KEV signals that regulators and auditors will expect evidence of timely remediation; a missing patch becomes a tangible audit finding.
- Defensible audit trail – Demonstrating that the patch was applied and that privileged‑account monitoring is in place provides the “defensible evidence” buyers now demand during security‑risk assessments.
Recommended Actions
- Deploy Microsoft’s security update (KB5006670 or later) to all Windows endpoints immediately.
- Verify patch rollout through an automated inventory or configuration‑management tool; capture screenshots or logs as evidence.
- Review privileged‑account inventories and enforce just‑in‑time elevation where possible.
- Enable Windows Event Log auditing for privilege‑escalation events (e.g., 4624, 4670) and forward logs to a SIEM for continuous monitoring.
Source: CISA KEV entry – CVE‑2021‑41379