CVE-2021-26862
📋 TL;DR
CVE-2021-26862 is a Windows Installer elevation of privilege vulnerability that allows authenticated attackers to execute arbitrary code with SYSTEM privileges by exploiting improper handling of file operations. This affects Windows systems where attackers have local access and can manipulate installer operations.
💻 Affected Systems
- Microsoft Windows
📦 What is this software?
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 7 by Microsoft
Windows 8.1 by Microsoft
Windows Rt 8.1 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with SYSTEM privileges, enabling complete control over the affected system, data theft, persistence mechanisms, and lateral movement.
Likely Case
Privilege escalation from a standard user account to SYSTEM privileges, allowing installation of malware, disabling security controls, or accessing protected resources.
If Mitigated
Limited impact with proper user access controls, application whitelisting, and monitoring in place, potentially preventing successful exploitation.
🎯 Exploit Status
Exploitation requires local authenticated access. Proof-of-concept code has been published, making exploitation straightforward for attackers with initial access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: March 2021 security updates (KB5000802 for most versions)
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26862
Restart Required: Yes
Instructions:
1. Apply March 2021 Windows security updates via Windows Update. 2. For enterprise environments, deploy through WSUS or SCCM. 3. Verify update installation with 'wmic qfe list' command.
🔧 Temporary Workarounds
Restrict installer permissions
windowsLimit user permissions to execute Windows Installer operations through Group Policy or application control policies.
Configure via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Windows Installer
Implement least privilege
windowsEnsure users operate with minimal necessary privileges to reduce attack surface.
🧯 If You Can't Patch
- Implement application control policies to restrict execution of unauthorized installer operations
- Monitor for suspicious installer activity and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Windows version and installed updates. Vulnerable if running affected versions without March 2021 security updates.Check Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify KB5000802 or equivalent March 2021 security update is installed via 'wmic qfe list | findstr KB5000802' or check Windows Update history.📡 Detection & Monitoring
Log Indicators:
- Windows Installer service events with unusual privilege escalation
- Event ID 11707, 11724 from MSIInstaller
- Unexpected SYSTEM privilege processes spawned from user contexts
Network Indicators:
- Not applicable - local exploitation only
SIEM Query:
EventID=11707 OR EventID=11724 | where ProcessName contains "msiexec" | where User contains "SYSTEM" and ParentUser != "SYSTEM"