CVE-2021-36955

CVE-2021-36955 is an elevation-of-privilege vulnerability in the Windows Common Log File System (CLFS) driver, the kernel component responsible for managing log files used by various Windows features. An attacker who can already run code locally with limited user privileges can trigger the flaw in the CLFS driver and escalate to SYSTEM without any user interaction (CVSS 3.1: 7.8, local vector, low privileges required). Successful exploitation grants full SYSTEM-level control of the host, which adversaries use to disable security tooling and chain with other exploits during ransomware operations. The affected footprint is broad: Windows 7, 8.1, RT 8.1, Windows 10 builds 1507 through 21H1, and Windows Server 2004 and 2008 as listed in CISA's data. The flaw is confirmed exploited in the wild and was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use; no standalone public proof-of-concept is known.

What to do: Apply the Microsoft Windows security updates that fix this flaw across all affected versions immediately, per the CISA KEV required action (the fix was shipped in Microsoft's monthly Patch Tuesday updates, including the September 2021 release). Prioritize hosts where untrusted users can log on locally or via RDP, since this is a local privilege escalation used to reach SYSTEM in ransomware chains. Verify remediation with vulnerability scans and confirm your assets are cleared against the CISA KEV catalog.