The PoC was found to be effective against servers patched with June 2021 updates under some constrains, including against domain controllers running under default configurations. However, it turned out that the vulnerability exploited by the PoC was not, in fact, identical to CVE-2021-1675. They shared on Twitter that they discovered the new vulnerability in the Print Spooler Windows service that allows RCE, indicating that it was CVE-2021-1675. Once the new CVE was published, security researchers Zhipeng Huo, Piotr Madej and Yunhai Zhang, that have disclosed the vulnerability details to Microsoft beforehand ( reportedly a year ago) and believed it was already fixed, decided to publish their work, including a proof-of-concept (PoC). Initially, it was classified as a low severity vulnerability allowing Local Privilege Escalation (LPE) and on June 21st, Microsoft changed the classification as it was discovered that the flaw allows Remote Code Execution (RCE) as well. As part of the June 2021 security updates, Microsoft addressed a Print Spooler vulnerability assigned with CVE-2021-1675. So how come exploits for this vulnerability were published before security patches were released, making it a critical zero-day vulnerability? Here is where the plot thickens.

It took Microsoft about 10 days to release security patches for all Windows versions that remediate this vulnerability and these patches are effective only under certain constrains that will be detailed later in this document. Since the service is enabled by default on any machine, and since this vulnerability practically enables any user in the internal network to fully compromise the Active Directory domain by exploiting a domain controller, it has gained major traction and requires an immediate response from organizations. It’s recommended to conduct hunting activities to identify exploitation of the PrintNightmare vulnerability.Ī newly discovered vulnerability in the Print Spooler Windows service, widely referred to as “PrintNightmare”, allows Remote Code Execution (RCE) on any Server or Workstation with the Print Spooler service enabled.We urge organizations to patch and follow our hardening and mitigation guidelines detailed below, as we expect ransomware threat actors to abuse this vulnerability in the immediate future.An urgent out-of-band urgent patch was released by Microsoft to remediate the vulnerability.Threat intel indicates the vulnerability is actively exploited in the wild.The vulnerability allows threat actors who gained initial access to the environment to fully compromise the network and deploy additional malware or ransomware.On June 28th, a critical remote code execution vulnerability was published, impacting Windows operating systems.

Fully sign a dll file