CVE-2021-43226

CVE-2021-43226 is an elevation-of-privilege vulnerability in the Windows Common Log File System (CLFS) driver, a kernel-mode component that manages common log files. A local attacker who already has limited privileges on a machine (the CVSS vector requires only low privileges, no user interaction, and a local attack vector) can trigger the flaw through crafted interactions with the CLFS driver and escalate to full SYSTEM-level control of the host. CISA notes known use in ransomware campaigns, where this class of local privilege escalation is typically chained after initial access. Affected deployments span essentially all supported Windows client releases of the era: Windows 7, Windows 8.1 and Windows RT 8.1, Windows 10 versions 1507 through 21H2, and Windows 11 21H2. The bug was patched in Microsoft's December 2021 Patch Tuesday as an actively exploited zero-day, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-10-06 with ransomware use noted, indicating demonstrated in-the-wild exploitation.

What to do: Install the December 2021 Patch Tuesday (or any later) cumulative update for each affected release on all Windows 7, 8.1, Windows 10, and Windows 11 21H2 systems, and verify patch coverage through WSUS/Intune or equivalent inventory, per CISA KEV and BOD 22-01 guidance. Because this is a post-compromise privilege escalation used in ransomware chains, prioritize endpoints where low-privileged users can log in and hosts in ransomware-prone network segments.