EXPOSURES › CVE-2021-1732
CVE-2021-1732
CRITICAL ⌖ ON CISA KEV · EXPLOITEDA Microsoft Win32k vulnerability allows privilege escalation and is actively exploited in ransomware attacks, impacting DIB organizations using Windows systems.
CVE-2021-1732 is a Win32k privilege escalation vulnerability being actively exploited, likely in conjunction with ransomware campaigns. DIB organizations relying on Windows must prioritize patching to prevent unauthorized access and potential data compromise, directly impacting CMMC compliance. Verify patching status and consider compensating controls.
Shame score — The vulnerability's active exploitation in ransomware attacks highlights a significant and preventable security risk within a core Windows component.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |