CVE-2021-36948

An unpatched privilege escalation flaw in Windows Update Medic Service was actively exploited in the wild, allowing attackers to escalate privileges on Windows systems.

This unpatched vulnerability in the Windows Update Medic Service allows attackers to escalate privileges, potentially leading to full system compromise. DIB organizations must ensure timely patching of Windows systems, as this flaw was actively exploited in the wild and is now on CISA's KEV catalog. The failure highlights the critical importance of maintaining up-to-date systems to prevent privilege escalation attacks.

Shame score — The vulnerability was unpatched and actively exploited in the wild, demonstrating a failure to patch known flaws and leaving systems vulnerable to privilege escalation attacks.