CVE-2021-1678

Think of the Windows Print Spooler like the receptionist who manages all print jobs in your office — it's a background service almost every Windows computer runs. This flaw means someone could trick a user into interacting with something that looks like a normal print job or document, and in doing so, hand the attacker full control of that computer — like giving a stranger the keys to your office because they handed you a fake delivery slip.

This matters to you if you run any version of Windows on your business computers or servers — including Windows 10, Windows 7, Windows 8.1, or Windows Server 2008 through 2019 — since the Print Spooler service is enabled by default on nearly all of them. The attack only works if a user is tricked into interacting with malicious content, so basic caution with unexpected files or printer connections reduces risk.

There is no confirmed evidence this flaw is being actively exploited in the wild, and no public exploit code exists for it, so this does not require emergency same-day action. However, because successful exploitation gives an attacker full control of the machine, you should apply the patch during your normal update cycle rather than deferring it indefinitely.

Confirm exposure by checking the OS build number on affected hosts (Windows 10, Server 2008/2008 R2/2012/2012 R2/2016/2019, 7, 8.1) and the Print Spooler service status. Apply the vendor fix per branch: Windows 10/Server (shared build) → 10.0.19041.1237; Server 2019 → 10.0.17763.2183; older Windows 10 branch → 10.0.18363.1801; Windows 10 1507 → 10.0.10240.19060; Server 2016 → 10.0.14393.4651; Windows 7 → 6.1.7601.25712; Windows 8.1 → 6.3.9600.20120. These are cumulative Windows updates, not package-manager installs, so deploy via Windows Update, WSUS, or SCCM. No documented breaking changes are associated with this fix. As a temporary mitigation if patching is delayed, restrict or disable the Print Spooler service on systems that don't need printing, and block inbound/outbound connections to untrusted print servers. No CISA KEV listing exists, so there is no federal remediation deadline. Monitor vendor and CISA KEV updates for any change in exploitation status, and track Microsoft's advisory page (MSRC update guide) for revisions.

CVSS 3.1 score is 8.8 (High), vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — network-exploitable, low complexity, no privileges required, but requires user interaction; impact is high across confidentiality, integrity, and availability. The weakness is classified as CWE-NVD-CWE-noinfo (spoofing-related, unspecified subtype) in the Windows Print Spooler component. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public exploit code has been identified. EPSS places predicted exploitation likelihood in a high percentile relative to other CVEs but with a falling trend, consistent with no confirmed in-the-wild activity to date.