Microsoft has issued an advisory for another zero-day Windows print spooler vulnerability tracked as CVE-2021-36958 that allows local attackers to gain SYSTEM privileges on a computer.
This vulnerability is part of a class of bugs known as “PrintNightmare,” which abuses configuration settings for the Windows print spooler, print drivers, and the Windows Point and Print feature.
Microsoft released security updates in both July and August to fix various PrintNightmare vulnerabilities.
However, a vulnerability disclosed by security researcher Benjamin Delpy still allows threat actors to quickly gain SYSTEM privileges simply by connecting to a remote print server, as demonstrated below.
Today, Microsoft issued an advisory on a new Windows Print Spooler vulnerability tracked as CVE-2021-36958
“A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations,” reads the CVE-2021-36958 advisory.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36958
We urge all agencies to patch this ASAP due to the critical nature. Patch management is an important aspect of adherence to best practices, and is one of the items we evaluate as part of our services. Contact us today for a quote to make sure your organization is adhering to best practices.
