Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Aug 12, 2021 · Catalog

   Detected

   Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.

2. Nov 3, 2021 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Nov 17, 2021 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Aug 10, 2026 · Catalog

   Updated

   Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.

Affected

• cpe microsoft/windows server 2004version unspecified
• cpe microsoft/windows server 2008version unspecified
• cpe microsoft/windows server 2008r2
• cpe microsoft/windows server 2012version unspecified
• cpe microsoft/windows server 2012r2
• cpe microsoft/windows server 2016version unspecified
• cpe microsoft/windows server 2019version unspecified
• cpe microsoft/windows server 20h2version unspecified
• vendor Microsoft Windowsversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2021-36942

  Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.

  cisa.gov
• CVE.orgVulnerability recordCVE-2021-36942

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2021-36942

  30-day exploitation probability 66.0%

  first.org
• Metasploit ModulesPublic exploit moduleauxiliary_scanner/dcerpc/petitpotam

  Public module reference (normal). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDVulnerability recordCVE-2021-36942

  Windows LSA Spoofing Vulnerability

  nvd.nist.gov

References

• Patch · msrc.microsoft.com
• CISA note · nvd.nist.gov
• Patch · portal.msrc.microsoft.com
• US Government Resource · cisa.gov
• Exploit · kb.cert.org