Windows Common Log File System (CLFS) Driver Local Privilege Escalation Vulnerability (CVE-2021-36955) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTMicrosoft Windows operating systems including Windows 7, 8.1, 10, 11, and Windows Server 2008, 2012, 2016, 2019, 2022
A local authenticated attacker can exploit this vulnerability to execute arbitrary code with SYSTEM privileges, leading to full host compromise
Immediately apply the official cumulative security updates provided by Microsoft and monitor unpatched assets
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to apply the official Microsoft cumulative security updates. Use the following PowerShell commands to check for and install missing security updates:
# Install PSWindowsUpdate module and force install missing security patches
Install-Module PSWindowsUpdate -Force -SkipPublisherCheck
Get-WindowsUpdate -Category 'Security Updates' -AcceptAll -Install -AutoReboot2. Temporary Workaround & Hardening Configuration
While there is no direct functional workaround for kernel-level driver vulnerabilities, you can reduce the attack surface by disabling unnecessary local accounts and hardening directory permissions:
:: Disable the local Guest account to prevent unauthorized local access
net user Guest /active:no
:: Verify and restrict write permissions on critical system log directories
icacls 'C:\Windows\System32\LogFiles' /inheritance:r /grant:r *S-1-5-32-544:(OI)(CI)(F) *S-1-5-18:(OI)(CI)(F)3. Log Audit & IoC Verification Commands
Verify the patch status by checking the file version of the clfs.sys driver on the system:
# Retrieve the file version of the CLFS driver
$clfsPath = 'C:\Windows\System32\drivers\clfs.sys'
if (Test-Path $clfsPath) {
(Get-Item $clfsPath).VersionInfo | Format-List -Property ProductName, ProductVersion, FileDescription
} else {
Write-Warning 'CLFS driver file not found.'
}Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-36955) is an elevation of privilege (EoP) vulnerability in the Windows Common Log File System (CLFS) driver (clfs.sys), a kernel-mode subsystem that provides high-performance transaction logging. The root cause lies in the driver's failure to properly validate and sanitize metadata structures within specially crafted Base Log Files (.blf). This lack of validation leads to out-of-bounds memory operations or corruption within the kernel pool.
2. Exploitation Mechanics & Attack Scenario
To exploit this vulnerability, an attacker must first gain local access with low-privilege user credentials on the target system. The attacker then triggers the loading of a maliciously crafted .blf file via CLFS API calls. When the kernel driver parses the corrupted control blocks, it miscalculates offsets or sizes, resulting in a kernel pool memory corruption. The attacker leverages this state to overwrite kernel function pointers or perform token stealing, elevating their privileges to NT AUTHORITY\SYSTEM.
3. Infrastructure & Business Impact
As a vulnerability listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, CVE-2021-36955 has been actively exploited in the wild. It serves as a critical stepping stone for threat actors during lateral movement and post-exploitation phases. Achieving SYSTEM privileges allows attackers to disable security agents (EDR/AV), deploy ransomware, and establish persistent backdoors, posing a severe threat to business continuity.
Official Vendor Advisories & References
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Frequently Asked SecOps Questions (CVE-2021-36955)
FAQQ1. How critical is CVE-2021-36955 and is it actively exploited in the wild?
CVE-2021-36955 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 4.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-36955?
Primary impacted vendors include microsoft across windows, windows_server. Scope summary: Most major versions of Windows and Windows Server (prior to the September 2021 security updates) utilizing the CLFS driver
Q3. What temporary mitigations or workarounds exist for CVE-2021-36955 before patching?
[Mitigation] Immediately apply the official cumulative security updates provided by Microsoft and monitor unpatched assets Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-36955
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Windows IKE Extension Double Free Remote Code Execution Vulnerability (CVE-2026-33824)
[Affected Scope] Internet Key Exchange (IKE) Extension service running on Microsoft Windows and Windows Server operating systems
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Windows AFD.sys Use-After-Free Local Privilege Escalation Vulnerability (CVE-2026-68820) Security Advisory
[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Ancillary Function Driver for WinSock (afd.sys)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.