CVE-2021-26415
📋 TL;DR
CVE-2021-26415 is an elevation of privilege vulnerability in Windows Installer that allows authenticated attackers to execute arbitrary code with SYSTEM privileges. This affects Windows systems where an attacker has local access and can run specially crafted files. The vulnerability stems from improper input validation (CWE-20) in the Windows Installer service.
💻 Affected Systems
- Windows Installer
📦 What is this software?
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 7 by Microsoft
Windows 8.1 by Microsoft
Windows Rt 8.1 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains full SYSTEM-level control over the affected Windows system, enabling installation of malware, data theft, lateral movement, and complete system compromise.
Likely Case
Privilege escalation from a standard user account to SYSTEM privileges, allowing attackers to bypass security controls and maintain persistence.
If Mitigated
Limited impact if proper patch management, least privilege principles, and application control policies are enforced.
🎯 Exploit Status
Exploitation requires authenticated user access. Proof-of-concept code has been published, making exploitation relatively straightforward for attackers with initial access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: March 2021 security updates (KB5000802 for most versions)
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26415
Restart Required: Yes
Instructions:
1. Apply the March 2021 Windows security updates from Microsoft Update. 2. For enterprise environments, deploy through WSUS or SCCM. 3. Restart affected systems after patch installation.
🔧 Temporary Workarounds
Disable Windows Installer service
windowsTemporarily disable the Windows Installer service to prevent exploitation (will break software installation functionality)
sc config msiserver start= disabled
net stop msiserver
Apply least privilege
allEnsure users operate with minimal necessary privileges to limit impact of successful exploitation
🧯 If You Can't Patch
- Implement application control policies (AppLocker/Windows Defender Application Control) to restrict execution of unauthorized code
- Monitor for suspicious Windows Installer service activity and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Windows Update history for March 2021 security updates or use: wmic qfe list | findstr "5000802"Check Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify KB5000802 or later March 2021 security updates are installed via: systeminfo | findstr "KB5000802"📡 Detection & Monitoring
Log Indicators:
- Windows Installer service (msiserver) spawning processes with SYSTEM privileges from user contexts
- Event ID 4688 with parent process msiserver.exe
- Unusual msi installer package execution patterns
Network Indicators:
- Not applicable - local privilege escalation
SIEM Query:
EventID=4688 AND ParentProcessName="msiserver.exe" AND NewProcessName NOT IN ("msiexec.exe", "trusted_installer.exe")