PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-34527 Microsoft CVE debrief

CVE-2021-34527 is a Microsoft Windows Print Spooler remote code execution issue that CISA lists in its Known Exploited Vulnerabilities catalog. The KEV entry marks it as known to be used in ransomware campaigns and directs defenders to apply vendor updates, with CISA ED 21-04 providing additional guidance and requirements.

Vendor
Microsoft
Product
Windows
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2021-11-03
Original CVE updated
2021-11-03
Advisory published
2021-11-03
Advisory updated
2021-11-03

Who should care

Windows administrators, endpoint and server operations teams, security operations, and managed service providers responsible for Microsoft Windows patching and service management should prioritize this issue, especially where Print Spooler is enabled.

Technical summary

This vulnerability affects Microsoft Windows Print Spooler and is categorized as a remote code execution issue. CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, noted known ransomware campaign use, and linked remediation to Microsoft vendor updates and CISA ED 21-04.

Defensive priority

Critical

Recommended defensive actions

  • Apply Microsoft updates per vendor instructions across all affected Windows systems.
  • Verify remediation against the CISA KEV entry and review CISA ED 21-04 for any remaining requirements.
  • Inventory Windows hosts that rely on Print Spooler and confirm patch status across workstations, servers, and managed endpoints.
  • If reviewing backlog or legacy environments, use the CISA KEV due date of 2022-05-03 as the historical remediation benchmark.

Evidence notes

The supplied CISA KEV source item identifies this CVE as a Microsoft Windows Print Spooler remote code execution vulnerability, sets dateAdded to 2021-11-03, and records knownRansomwareCampaignUse as Known. Its metadata says to apply updates per vendor instructions and references CISA ED 21-04 for further guidance and requirements. The CVE and source timeline fields both show 2021-11-03 as the published and modified date.

Official resources

Publicly disclosed in CISA's Known Exploited Vulnerabilities catalog on 2021-11-03. The KEV metadata states known ransomware campaign use and references CISA ED 21-04.