CVE-2021-36934

🗓️ 22 Jul 2021 07:05:12Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 11 Media mentions👁 1354 Views🌐 WEB

Windows Elevation of Privilege Vulnerability CVE-2021-3693

Reporter	Title	Published	Views	Family All 51
Gitee	Exploit for CVE-2020-1472	8 Oct 202115:47	–	gitee
GithubExploit	Exploit for CVE-2021-36934	12 Aug 202118:01	–	githubexploit
GithubExploit	Exploit for CVE-2021-36934	25 Jul 202100:31	–	githubexploit
GithubExploit	Exploit for CVE-2021-36934	20 Jul 202122:16	–	githubexploit
GithubExploit	Exploit for Use After Free in Microsoft	21 Jan 202611:14	–	githubexploit
GithubExploit	Exploit for CVE-2021-36934	26 Jul 202108:01	–	githubexploit
GithubExploit	Exploit for CVE-2021-36934	21 Jul 202113:06	–	githubexploit
GithubExploit	Exploit for CVE-2021-36934	22 Jul 202103:07	–	githubexploit
GithubExploit	Exploit for CVE-2021-36934	21 Jul 202117:24	–	githubexploit
GithubExploit	Exploit for CVE-2021-36934	22 Jul 202112:24	–	githubexploit

NVD

Vulners

Node

microsoft windows_10_1809Range<10.0.17763.2114

microsoft windows_10_1909Range<10.0.18363.1734

microsoft windows_10_2004Range<10.0.19041.1165

microsoft windows_10_20h2Range<10.0.19042.1165

microsoft windows_10_21h1Range<10.0.19043.1165

[
  {
    "vendor": "Microsoft",
    "product": "Windows 10 Version 1809",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2114:*:*:*:*:*:x86:*",
      "cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2114:*:*:*:*:*:x64:*",
      "cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.2114:*:*:*:*:*:arm64:*"
    ],
    "platforms": [
      "32-bit Systems",
      "x64-based Systems",
      "ARM64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "10.0.17763.2114",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows 10 Version 1909",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1734:*:*:*:*:*:x86:*",
      "cpe:2.3:o:microsoft:windows_10_1909:10.0.18363.1734:*:*:*:*:*:x64:*",
      "cpe:2.3:o:microsoft:windows_10_1809:10.0.18363.1734:*:*:*:*:*:x64:*"
    ],
    "platforms": [
      "32-bit Systems",
      "x64-based Systems",
      "ARM64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "10.0.18363.1734",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows 10 Version 21H1",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1165:*:*:*:*:*:x64:*",
      "cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1165:*:*:*:*:*:arm64:*",
      "cpe:2.3:o:microsoft:windows_10_21H1:10.0.19043.1165:*:*:*:*:*:x86:*"
    ],
    "platforms": [
      "x64-based Systems",
      "ARM64-based Systems",
      "32-bit Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "10.0.19043.1165",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows 10 Version 2004",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_10_1809:10.0.19041.1165:*:*:*:*:*:x64:*"
    ],
    "platforms": [
      "32-bit Systems",
      "ARM64-based Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "10.0.19041.1165",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Windows 10 Version 20H2",
    "cpes": [
      "cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1165:*:*:*:*:*:x86:*",
      "cpe:2.3:o:microsoft:windows_10_20H2:10.0.19042.1165:*:*:*:*:*:arm64:*"
    ],
    "platforms": [
      "32-bit Systems",
      "ARM64-based Systems"
    ],
    "versions": [
      {
        "version": "10.0.0",
        "lessThan": "10.0.19042.1165",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.html
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
kb	www.kb.cert.org/vuls/id/506989

Parameter	Position	Path	Description
HarddiskVolumeShadowCopy0	path	\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy0\\Windows\\System32\\config\\SAM	Access SAM hive via Shadow Copy (HiveNightmare)
SAM	path	\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy0\\Windows\\System32\\config\\SAM	Access SAM hive via Shadow Copy (HiveNightmare)
HarddiskVolumeShadowCopy0	path	\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy0\\Windows\\System32\\config\\SYSTEM	Access SYSTEM hive via Shadow Copy (HiveNightmare)
SYSTEM	path	\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy0\\Windows\\System32\\config\\SYSTEM	Access SYSTEM hive via Shadow Copy (HiveNightmare)

17 Jun 2026 03:59Current

9.1High risk

Vulners AI Score9.1

CVSS 24.6

CVSS 3.17.8

EPSS0.67252

SSVC

In Wild