CVE-2021-28310

A privilege escalation vulnerability in Microsoft Win32k was actively exploited in the wild, allowing attackers to escalate privileges on Windows systems.

This vulnerability in the Windows Win32k subsystem allows an attacker to escalate privileges without needing prior access, directly impacting systems that rely on Windows for secure operations. DIB organizations must ensure all Windows systems are patched immediately, as this flaw was actively exploited before a patch existed, indicating a critical gap in the vendor's patch cycle. Failure to patch exposes systems to unauthorized access and potential data breaches, violating CMMC/NIST 800-171 requirements for timely patch management.

Shame score — The vulnerability was actively exploited in the wild before a patch was available, demonstrating a critical failure in Microsoft's patch management and leaving systems vulnerable to privilege escalation attacks.