CVE-2021-34484: Windows 10 Privilege Escalation Flaw

CVE-2021-34484 Overview

CVE-2021-34484 is an elevation of privilege vulnerability in the Windows User Profile Service. An authenticated local attacker can abuse the service to elevate privileges on a vulnerable Windows host. The flaw affects a broad range of Windows client and server releases, from Windows 7 and Server 2008 through Windows 10 21H1 and Server 20H2. CISA has added this CVE to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in real-world attacks.

Critical Impact
A local, authenticated attacker can elevate privileges through the Windows User Profile Service, leading to full compromise of confidentiality, integrity, and availability on the affected system.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 1909, 2004, 20H2, 21H1)
Microsoft Windows 7 SP1, Windows 8.1, and Windows RT 8.1
Microsoft Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, Server 2004, and Server 20H2

Discovery Timeline

2021-08-12 - CVE-2021-34484 published to the National Vulnerability Database (NVD)
2025-10-30 - Last updated in the NVD database

Technical Details for CVE-2021-34484

Vulnerability Analysis

The vulnerability resides in the Windows User Profile Service, a system component responsible for loading and managing user profiles at logon. An authenticated local user can manipulate how the service processes profile paths and junction points to perform privileged file operations outside their authorized scope. Successful exploitation yields code execution in the context of a higher-privileged account, typically NT AUTHORITY\SYSTEM.

The issue is locally exploitable, requires low privileges, and needs no user interaction. According to EPSS data, the vulnerability sits in the 86th percentile for exploitation likelihood, and CISA KEV listing confirms in-the-wild abuse.

Root Cause

Microsoft has not published detailed root-cause analysis under [NVD-CWE-noinfo]. Public research on the original patch demonstrated that the User Profile Service mishandled profile directory operations during logon, allowing a low-privileged user to influence file system operations performed by SYSTEM. The initial fix was later shown to be incomplete, leading to follow-on bypass research that reused the same primitive against the User Profile Service code path.

Attack Vector

An attacker with valid local credentials prepares filesystem artifacts, such as symbolic links or directory junctions, in locations the User Profile Service touches during profile creation or loading. By triggering the service, often through interactive logon or service interaction, the attacker redirects privileged file operations to attacker-controlled targets. The result is arbitrary file write or DLL planting executed as SYSTEM, leading to full local privilege escalation.

No public proof-of-concept code is referenced in this CVE record. Refer to the Microsoft Security Advisory CVE-2021-34484 for vendor technical guidance.

Detection Methods for CVE-2021-34484

Indicators of Compromise

Unexpected child processes spawned by svchost.exe hosting the User Profile Service (ProfSvc), particularly command interpreters or rundll32.exe running as SYSTEM.
Creation of symbolic links, junctions, or hard links by standard users targeting paths under C:\Users\ or C:\ProgramData\.
New or modified DLLs appearing in user-writable profile directories shortly before privileged process loads.
Sudden privilege transitions where a low-privileged session is followed by SYSTEM-level activity originating from the same logon session.

Detection Strategies

Hunt for non-administrative users creating reparse points using mklink /J or CreateSymbolicLinkW against profile-related directories.
Alert on ProfSvc performing file writes into directories controlled by standard users.
Correlate Windows Event ID 4672 (special privileges assigned) with preceding standard-user activity from the same session.

Monitoring Recommendations

Enable Sysmon with rules covering process creation (Event ID 1), file create (Event ID 11), and file stream creation in profile paths.
Forward User Profile Service operational logs and Security event logs to a centralized SIEM for behavioral analytics.
Track patch compliance for the August 2021 cumulative updates across all Windows endpoints and servers.

How to Mitigate CVE-2021-34484

Immediate Actions Required

Apply Microsoft's August 2021 (and subsequent) cumulative security updates that address the User Profile Service flaw, per the Microsoft Security Advisory CVE-2021-34484.
Prioritize remediation on multi-user systems such as terminal servers, VDI hosts, and shared workstations where local users are most likely to abuse the flaw.
Audit local user accounts and remove unnecessary interactive logon rights to reduce the attack surface.
Cross-reference the CISA Known Exploited Vulnerabilities Catalog entry for CVE-2021-34484 to validate remediation against federal deadlines.

Patch Information

Microsoft released updates addressing CVE-2021-34484 as part of its monthly security guidance. Administrators should consult the Microsoft Security Advisory CVE-2021-34484 for the specific KB articles and build numbers for each affected Windows version. Note that subsequent research disclosed bypasses of the initial fix, so apply the latest cumulative updates rather than the original August 2021 patch in isolation.

Workarounds

Restrict interactive and remote interactive logon rights to administrators where business requirements allow.
Disable creation of user profiles for accounts that do not require local profile state, reducing exposure to the vulnerable code path.
Monitor and block creation of symbolic links by non-privileged users by ensuring the SeCreateSymbolicLinkPrivilege is not granted to standard accounts.

bash

# Verify which accounts hold SeCreateSymbolicLinkPrivilege
secedit /export /cfg C:\Temp\secpol.cfg
findstr /I "SeCreateSymbolicLinkPrivilege" C:\Temp\secpol.cfg

# Confirm User Profile Service patch level via installed updates
wmic qfe list brief /format:table