Microsoft Windows SAM Database Overly Permissive ACL Local Privilege Escalation (SeriousSAM / HiveNightmare - CVE-2021-36934)
Executive & SecOps Summary
SECOPS ASSESSMENTWindows 10 version 1809 and later, and Windows Server 2019 and later
Local users can read sensitive registry hives (SAM, SYSTEM, SECURITY) via Volume Shadow Copies, leading to full SYSTEM privilege escalation and credential theft
Apply the official security update, then manually delete all existing Volume Shadow Copies (VSS) and create new ones to fully mitigate the risk
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Install the latest cumulative security updates provided by Microsoft. You can force the update process using PowerShell.
# Install and force Windows Update for cumulative security patches
Install-Module PSWindowsUpdate -Force -Verbose
Get-WindowsUpdate -AcceptAll -Install -AutoReboot2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the config directory and delete existing vulnerable shadow copies to prevent exploitation.
:: 1. Restrict access to the System32\config directory
icacls %windir%\system32\config\*.* /inheritance:e
:: 2. Delete existing Volume Shadow Copies to remove vulnerable backups
vssadmin delete shadows /for=c: /all /quiet3. Log Audit & IoC Verification Commands
Use the following PowerShell script to verify if the SAM file ACL is currently vulnerable and check for the presence of shadow copies.
# Check if the 'Users' group has read access to the SAM file
$samPath = 'C:\Windows\System32\config\SAM'
$acl = Get-Acl -Path $samPath
$isVulnerable = $false
foreach ($access in $acl.Access) {
if ($access.IdentityReference -like '*Users*' -and $access.FileSystemRights -match 'Read') {
$isVulnerable = $true
}
}
if ($isVulnerable) {
Write-Warning 'VULNERABLE: Non-privileged users have read access to the SAM database.'
} else {
Write-Output 'SECURE: SAM database ACLs are properly restricted.'
}Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability, widely known as 'SeriousSAM' or 'HiveNightmare', arises due to overly permissive Access Control Lists (ACLs) on critical system files within the 'Windows\System32\config' directory, including the Security Accounts Manager (SAM) database. Starting with Windows 10 version 1809, the 'BUILTIN\Users' group was mistakenly granted read permissions to these sensitive registry hives. While active files are locked by the operating system during runtime, backup copies created by the Volume Shadow Copy Service (VSS) inherit these permissive ACLs and remain readable without lock restrictions.
2. Exploitation Mechanics & Attack Scenario
An attacker with local execution capabilities can query the Volume Shadow Copy Service to locate available shadow copies of the system drive. By accessing the raw backup path (e.g., '\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM'), the attacker can bypass OS file locks and copy the SAM, SYSTEM, and SECURITY hives. Using offline extraction tools, the attacker can decrypt the SAM database to retrieve NTLM password hashes of local administrators and domain-cached accounts, enabling local privilege escalation to SYSTEM or lateral movement via Pass-the-Hash.
3. Infrastructure & Business Impact
As a highly critical vulnerability listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, this flaw poses an immediate threat to enterprise environments. Successful exploitation allows low-privileged insiders or external attackers who have established an initial foothold to instantly compromise the entire host. In Active Directory environments, this can lead to the exposure of domain credentials, facilitating domain-wide compromise, ransomware deployment, and catastrophic business disruption.
Official Vendor Advisories & References
An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.
Frequently Asked SecOps Questions (CVE-2021-36934)
FAQQ1. How critical is CVE-2021-36934 and is it actively exploited in the wild?
CVE-2021-36934 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 67.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-36934?
Primary impacted vendors include microsoft across windows, windows_server. Scope summary: Windows 10 (1809 and later) and Windows Server (2019 and later) with Volume Shadow Copy Service (VSS) enabled
Q3. What temporary mitigations or workarounds exist for CVE-2021-36934 before patching?
[Mitigation] Apply the official security update, then manually delete all existing Volume Shadow Copies (VSS) and create new ones to fully mitigate the risk Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-36934
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Windows IKE Extension Double Free Remote Code Execution Vulnerability (CVE-2026-33824)
[Affected Scope] Internet Key Exchange (IKE) Extension service running on Microsoft Windows and Windows Server operating systems
Windows Remote Access Connection Manager (RasMan) Null Pointer Dereference Local DoS Vulnerability (CVE-2026-21525) Technical Advisory
[Affected Scope] Windows and Windows Server operating systems utilizing the Windows Remote Access Connection Manager (RasMan) service.
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.