High8.8Microsoft Server Exploited CISA KEV

High [CVE-2021-1675 +1] Windows Print Spooler Remote Code Execution Vulnerability

This high-severity Microsoft Server advisory covers CVE-2021-1675 and CVE-2021-34527 affecting Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2012 (Server Core installation).

CVE-2021-34527 Published Jul 2, 2021Updated by vendor Aug 10, 2026

CVE-2021-1675 CVE-2021-34527

Affected products & platforms

Microsoft ServerWindows Server

Open vendor advisory

Android app · Google Play

Monitor future Microsoft Server CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges.

An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. UPDATE July 7, 2021: The security update for Windows Server 2012, Windows Server 2016 and Windows 10, Version 1607 have been released.

Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately.

If you are unable to install these updates, see the FAQ and Workaround sections in this CVE for information on how to help protect your system from this vulnerability.

In addition to installing the updates, in order to secure your system, you must confirm that the following registry settings are set to 0 (zero) or are not defined (Note: These registry keys do not exist by default, and therefore are already at the secure setting.), also that your Group Policy setting are correct (see FAQ):

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint NoWarningNoElevationOnInstall = 0 (DWORD) or not defined (default setting)

Having NoWarningNoElevationOnInstall set to 1 makes your system vulnerable by design.

CISA Known Exploited Vulnerability

Listed:: Nov 3, 2021 · federal remediation due Nov 17, 2021
Required action:: Apply updates per vendor instructions.
Ransomware use:: Known

KEV is a prioritization signal from CISA — remediation detail still comes from the vendor advisory.

Affected versions

Windows 10 Version 1507 10.0.10240.0 before 10.0.10240.18969
Windows 10 Version 1607 10.0.14393.0 before 10.0.14393.4470
Windows 10 Version 1809 10.0.17763.0 before 10.0.17763.2029
Windows 10 Version 1809 10.0.0 before 10.0.17763.2029
Windows 10 Version 20H2 10.0.0 before 10.0.19042.1083
Windows 10 Version 21H2 10.0.19044.0 before 10.0.19044.1415
Windows 10 Version 22H2 10.0.19045.0 before 10.0.19045.2251
Windows 11 version 21H2 10.0.22000.0 before 10.0.22000.318
Windows 11 version 22H2 10.0.22621.0 before 10.0.22621.674
Windows 8.1 6.3.0 before 6.3.9600.20046
Windows Server 2008 R2 Service Pack 1 6.1.7601.0 before 6.1.7601.25633
Windows Server 2008 R2 Service Pack 1 (Server Core installation) 6.1.7601.0 before 6.1.7601.25633

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Fixed versions

10.0.10240.18969
10.0.14393.4470
10.0.17763.2029
10.0.19042.1083
10.0.19044.1415
10.0.19045.2251
10.0.22000.318
10.0.22621.674
6.3.9600.20046
6.1.7601.25633
6.0.6003.21138
6.2.9200.23383

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation

An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
UPDATE July 7, 2021: The security update for Windows Server 2012, Windows Server 2016 and Windows 10, Version 1607 have been released.
Please see the Security Updates table for the applicable update for your system.
We recommend that you install these updates immediately.
UPDATE July 6, 2021: Microsoft has completed the investigation and has released security updates to address this vulnerability.

Temporary workarounds

If you are unable to install these updates, see the FAQ and Workaround sections in this CVE for information on how to help protect your system from this vulnerability.

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Sources

Official and corroborating records used to build this advisory.

Official vendor advisoryofficial
Official advisory page fetched and parsed; accepted detail fields are attributed to this page.
Microsoft Server
CVE.org CNA recordCVE.org
Independent CNA record used for near-real-time discovery and missed-CVE reconciliation. Discovered from the machine-readable feed https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/delta.json; this link opens the CVE.org record for CVE-2021-1675 instead of the raw feed document.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

Official resources

MSRC Security Update Guide
Official documentation
Filter by this CVE for per-product KB numbers, severity and exploitability assessment.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.