{"id":17425,"date":"2021-07-13T08:29:36","date_gmt":"2021-07-13T08:29:36","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=17425"},"modified":"2026-04-17T18:07:46","modified_gmt":"2026-04-17T18:07:46","slug":"windows-print-spooler-rce-vulnerabilities-cve-2021-1675-cve-2021-34527-mitigation-guide","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/windows-print-spooler-rce-vulnerabilities-cve-2021-1675-cve-2021-34527-mitigation-guide\/","title":{"rendered":"Windows Print Spooler RCE Vulnerabilities (CVE-2021-1675\/CVE-2021-34527) Mitigation Guide"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

On July 7, 2021, Beijing time, Microsoft released a security patch on the PrintNightmare vulnerability (CVE-2021-34527). NSFOCUS CERT recommends that users install this patch as soon as possible.<\/p>\n\n\n\n

On June 29, NSFOCUS CERT found that a security researcher published an exploit of the Windows Print Spooler remote code execution (RCE) vulnerability (PrintNightmare) on GitHub. Print Spooler is a print-related service in Windows for managing all local and network print queues and controlling all print jobs. The Print Spooler service is enabled by default<\/strong> on Windows. A common user can exploit this RCE vulnerability to elevate to a SYSTEM user. In a domain environment, a domain user can exploit this vulnerability to execute arbitrary code on the domain controller with SYSTEM privileges, thus taking control of the entire domain. NSFOCUS’s research team found that this vulnerability could still be exploited even if a fix released by Microsoft in June for CVE-2021-1675 had been installed. <\/strong>On July 2, Beijing time, Microsoft released an advisory on the CVE-2021-34527 vulnerability and provided a workaround.<\/p>\n\n\n\n

Before that, Mimikatz had weaponized the exploit:<\/p>\n\n\n\n

\"Red<\/figure>\n\n\n\n

Reference links:<\/p>\n\n\n\n