CVE-2021-34486

CVE-2021-34486 is a use-after-free flaw (CWE-416) in the Windows Event Tracing (ETW) component of Windows 10 and Windows Server. An attacker who can already run low-privileged code on a target system can trigger improper memory reuse in ETW to execute code with elevated privileges, with no user interaction required (CVSS 3.1: 7.8, AV:L/AC:L/PR:L/UI:N). Successful exploitation yields privileged, likely SYSTEM-level, control of the host, which adversaries typically chain with other access for full system compromise. The affected releases span Windows 10 versions 1809, 1909, 2004, 20H2 and 21H1, plus Windows Server 2019, 2004 and 20H2. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-28, confirming exploitation in the wild; CISA lists ransomware use as unknown and no public proof-of-concept is known.

What to do: Apply Microsoft's security updates per vendor instructions (the CISA-required action) for all affected Windows 10 and Windows Server versions, or upgrade branches that are no longer serviced. Because exploitation requires local code execution, prioritize hosts where untrusted users or code run, such as workstations, shared systems and remote/terminal servers. Review EDR telemetry for local privilege-escalation activity on systems awaiting patching.