CVE-2021-34484

A privilege escalation vulnerability in the Windows User Profile Service was actively exploited in the wild, allowing attackers to escalate privileges without requiring remote code execution.

This unpatched vulnerability in Windows allows local privilege escalation, meaning attackers who gain initial access can elevate their privileges to SYSTEM. For DIB organizations, this means any compromised endpoint can be fully controlled, violating CMMC/NIST 800-171 requirements for system integrity and access control. Organizations must ensure all Windows systems are patched immediately and monitor for signs of privilege escalation activity.

Shame score — The vulnerability was actively exploited in the wild (KEV) and remained unpatched for a significant period, allowing widespread compromise of Windows systems.