CVE-2021-36934General(microsoft / windows_10_1809)

LOWCVSS 7.8 · HIGHCISA KEV

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch microsoft windows_10_1809 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.

microsoft CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-02-24. Apply updates per vendor instructions.

Patch / fix

Vendor / third-party advisories

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36934

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_10_1809
windows_10_1909
windows_10_2004
windows_10_20h2

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
General: 3 classified signals
Peaked at 2 mentions on most recent observed day (2026-07-04)
4 total mentions across 3 days

Affected systems

Vendors

microsoft

Products

windows_10_1809windows_10_1909windows_10_2004windows_10_20h2windows_10_21h1

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

General

375.0%

Patch

125.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-15	1	General1
2026-06-16	1	General1
2026-07-04	2	General1Patch1

Full discourse4 posts

OS Dev@OSdev_100d
General
CVE-2021-36934 (HiveNightmare / SeriousSAM) is a Windows privilege escalation vulnerability caused by overly permissive ACLs, not memory corruption. A Windows update assigned incorrect permissions to the SAM, SYSTEM, and SECURITY registry hive files. By accessing copies of these hives through Volume Shadow Copy, a local attacker could extract credential material, recover local account password hashes, and use them to elevate privileges. It's an excellent case study in Windows Registry internals, NTFS ACLs, Volume Shadow Copy, and why security boundaries depend just as much on correct permissions as secure code.
Post summary
The post provides a concise technical overview of CVE‑2021‑36934, detailing how privilege escalation is achieved through misconfigured ACLs on registry hives, without mentioning PoCs, exploits, patches, or active exploitation.
210067183.9K
5.0K followersView on X
OS Dev@OSdev_118d
General
One of the most interesting Windows kernel bugs is CVE-2021-36934, better known as HiveNightmare. https://www.sentinelone.com/vulnerability-database/cve-2021-36934/ The issue wasn't memory corruption or a race condition, it was a simple ACL misconfiguration. The "SAM", "SYSTEM", and "SECURITY" registry hive backups inside "C:\Windows\System32\config\RegBack" could be read by low-privileged users, exposing password hashes and secrets that should never leave the kernel's trust boundary.
Post summary
The post explains the HiveNightmare Windows kernel ACL misconfiguration that allows low‑privileged users to read sensitive registry hive backups, but it offers no PoC, exploit code, active exploitation evidence, or patch information.
0601971.5K
4.8K followersView on X
OS Dev@OSdev_100d
Patch
https://www.sentinelone.com/blog/hivenightmare-protecting-windows-10-security-account-manager-against-cve-2021-36934/
Post summary
SentinelOne discusses CVE‑2021‑36934, outlining its technical details and recommending the Microsoft patch or a specific workaround to mitigate the issue.
02042444
5.0K followersView on X
truemorgan@_truemorgan149d
General
Windows: CVE-2017-0144 CVE-2017-0145 CVE-2008-4250 CVE-2019-0708 CVE-2020-1472 CVE-2021-34527 CVE-2021-26855 CVE-2020-1350 CVE-2003-0352 CVE-2014-6324 CVE-2017-0199 CVE-2021-40444 CVE-2022-30190 CVE-2021-31166 CVE-2022-21907 CVE-2019-1182 CVE-2019-1181 CVE-2020-0601 CVE-2023-29363 CVE-2023-32014 CVE-2025-24985 CVE-2025-24993 CVE-2024-38063 CVE-2022-34718 CVE-2021-26857 CVE-2021-36934 CVE-2022-37969 CVE-2022-41033 CVE-2022-38028 CVE-2023-28252 CVE-2024-26169 CVE-2025-29824 CVE-2025-30400 CVE-2025-32701 CVE-2025-32706 CVE-2016-0099 CVE-2020-1048 CVE-2017-8529 CVE-2020-0688 CVE-2021-42287 CVE-2021-42278 CVE-2022-26923 CVE-2021-34523 CVE-2021-31207 CVE-2026-32202 CVE-2017-5754 CVE-2017-5753 CVE-2018-3639 CVE-2019-11135 CVE-2018-3620
Post summary
The text lists multiple Windows CVE identifiers without offering any evidence of PoCs, exploits, active use, patches, or detailed technical information.
10000106
15 followersView on X

CPE platform detail5 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

5 of 5 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_10_1809	-	-	-
OS	microsoft	windows_10_1909	-	-	-
OS	microsoft	windows_10_2004	-	-	-
OS	microsoft	windows_10_20h2	-	-	-
OS	microsoft	windows_10_21h1	-	-	-

Explore more

Back to dashboard microsoft CVEs windows_10_1809 vulnerabilities

What researchers are saying

CVE-2021-36934

OS Dev[verified]@OSdev_General

The post provides a concise technical overview of CVE‑2021‑36934, detailing how privilege escalation is achieved through misconfigured ACLs on registry hives, without mentioning PoCs, exploits, patches, or active exploitation.

OS Dev[verified]@OSdev_General

The post explains the HiveNightmare Windows kernel ACL misconfiguration that allows low‑privileged users to read sensitive registry hive backups, but it offers no PoC, exploit code, active exploitation evidence, or patch information.

OS Dev[verified]@OSdev_Patch

SentinelOne discusses CVE‑2021‑36934, outlining its technical details and recommending the Microsoft patch or a specific workaround to mitigate the issue.

truemorgan[verified]@_truemorganGeneral

The text lists multiple Windows CVE identifiers without offering any evidence of PoCs, exploits, active use, patches, or detailed technical information.