CVE-2021-40449

Exploited in the wild. In CISA KEV since 2021‑11‑17. Fixed versions are out.

CVSS 3.17.8High EPSS percentile99th82% chance in 30 days CISA KEVListedsince 2021-11-17, due 2021-12-01
Public exploit: 1 source Fix5 products7 fixed builds listed below

Published 2021-10-13Updated 2025-10-30Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Microsoft Windows 10 Version 1809Affected: ≥ 10.0.0, < 10.0.17763.2237Upgrade to: 10.0.17763.2237Affected: ≥ 10.0.0, < 10.0.18363.1854Upgrade to: 10.0.18363.1854Affected: ≥ 10.0.0, < 10.0.19041.1288Upgrade to: 10.0.19041.1288Affected: ≥ 10.0.0, < 10.0.10240.19086Upgrade to: 10.0.10240.19086 + 1 more branchStated by: CVE record
Microsoft Windows Server 2019Affected: ≥ 10.0.0, < 10.0.17763.2237Upgrade to: 10.0.17763.2237Stated by: CVE record
Microsoft Windows Server 2022Affected: ≥ 10.0.0, < 10.0.20348.288Upgrade to: 10.0.20348.288Stated by: CVE record
Microsoft Windows Server version 2004Affected: ≥ 10.0.0, < 10.0.19041.1288Upgrade to: 10.0.19041.1288Affected: ≥ 10.0.0, < 10.0.19042.1288Upgrade to: 10.0.19042.1288Stated by: CVE record
Microsoft Windows 11 version 21H2Affected: ≥ 10.0.0, < 10.0.22000.258Upgrade to: 10.0.22000.258Stated by: CVE record

Versions as the sources state them. 7 more products have version data. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your devices run one of these affected systems: Windows 7, Windows 8.1, Windows 10, Windows RT 8.1, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, or Windows Server 2022.
For each affected device, confirm whether it is already patched to at least the fixed build for your OS (see step 3).
Update each device using Windows Update or your patch management tool until it reaches the fixed version for your product:
- Windows 10 / Windows Server 2019: fixed in 10.0.17763.2237, 10.0.18363.1854, or 10.0.19041.1288
- Windows Server 2016: fixed in 10.0.14393.4704
- Windows 7: fixed in 6.1.7601.25740
- Windows Server 2012 / 2012 R2 / Server 2008 / Server 2008 R2: apply the vendor’s update guidance for this CVE via your supported update channel
- Windows Server 2022: fixed in 10.0.20348.288
- Windows 11: fixed in 10.0.22000.258
- Windows 10 (older supported lines): fixed in 10.0.10240.19086 or 10.0.14393.4704
Re-check the device patch level after updating, and prioritize servers and any machines reachable from the internet or used for admin work.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

0 publishers

Added to CISA KEV catalog
Nov 17, 2021·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened.

What it is

From the CVE record

Win32k Elevation of Privilege Vulnerability

In plain language

Written by AI from the record

CVE-2021-40449 is a Windows security flaw that can let an attacker gain much higher control of a device; because it’s been used in real ransomware activity, most small businesses running affected Windows versions should treat it as urgent and patch.

CVE-2021-40449 is a Win32k elevation of privilege weakness (CWE-416) that enables attackers to escalate privileges on affected Windows systems; it was added to CISA’s KEV list and has been used in ransomware campaigns.

If you're affected

Ransomware spread and privilege gain
Full system compromise
Data encryption and lockout
Server and workstation takeover

What is it

This Windows flaw is like a “lock that still opens, even if you’re not supposed to,” but for computer privileges. If someone can trigger it, they may be able to jump from normal access to high control of the machine—making it easier to run ransomware or take over the device.

Who is affected

This matters if you run (or support) Windows desktop or server systems including Windows 7, Windows 8.1, Windows 10, Windows RT 8.1, Windows Server 2008/2008 R2, Windows Server 2012/2012 R2, Windows Server 2016, and Windows Server 2019/2022. The issue is on Windows’ core GUI/kernel area (Win32k), so it targets the device itself rather than a single app.

How urgent is it

Attackers have already used this vulnerability in real ransomware campaigns, and CISA has included it in its KEV list—so this is not theoretical. Treat it as a RED issue: patch all affected Windows systems as a priority, starting with servers and any internet-facing or admin-access machines.

What to do — in detail

Inventory affected Windows versions
- Build a list of endpoints and servers running: Windows 7, Windows Server 2008/2008 R2, Windows 8.1, Windows Server 2012/2012 R2, Windows 10, Windows Server 2016, Windows RT 8.1, Windows Server 2019, Windows Server 2022, and Windows 11.
Determine patch status per device
- Compare each device’s installed Windows build (the OS version/build number shown in Windows settings/system info) to the fixed versions below.
Patch to fixed builds (target minimums)
- Windows 10 / Windows Server 2019: fixed in 10.0.17763.2237, or 10.0.18363.1854, or 10.0.19041.1288
- Windows Server 2016: fixed in 10.0.14393.4704
- Windows 7: fixed in 6.1.7601.25740
- Windows Server 2022: fixed in 10.0.20348.288
- Windows 11: fixed in 10.0.22000.258
- Additional Windows 10 lines mentioned as fixed: 10.0.10240.19086 and 10.0.14393.4704
If you can’t patch immediately (temporary mitigation)
- Reduce exposure: restrict which machines can be reached from untrusted networks and limit admin activities on high-risk endpoints.
- Apply the vendor’s recommended update approach as soon as possible through your organization’s patch process.
- Use compensating controls (least privilege, restrict who can execute software) until the fixed build is installed.
Verification
- After patching, re-check each device’s build number and confirm it meets or exceeds the fixed build for its Windows line.
Timeline and monitoring
- CISA KEV remediation due date for this CVE was 2021-12-01; prioritize reaching compliance immediately.
- Monitor for signs of ransomware activity on endpoints/servers (unusual process activity, mass file changes, ransom notes) as part of your normal incident detection.

Technical context

Severity is HIGH (CVSS 7.8). CVE-2021-40449 is an elevation of privilege flaw tied to Win32k (CWE-416). The weakness has confirmed real-world exploitation per CISA KEV and is described as used in ransomware campaigns; public exploit code is also available (1 known). Exploitation readiness is therefore high. KEV indicates required remediation by CISA and is treated as authoritative over prediction; EPSS exists but is not relied on for urgency here. Attack vector is local (per the CVSS notation), consistent with privilege escalation after gaining some foothold, and impact is system compromise with confidentiality/integrity/availability consequences. Given KEV listing and weaponization, this is mature enough to be actively abused.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Listed as exploited in the wild since 2021-11-17.

US federal agencies must remediate by 2021-12-01.

Known use in ransomware campaigns.

Apply updates per vendor instructions.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

82% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 127 days before any public exploit.

2026-06-25OpenVAS check added
2026-06-22EPSS band changecritical → high
2026-03-06Public exploit / PoCsource: packetstorm
2025-10-30Patch availablerecord updated
2021-11-17Added to CISA KEVransomware campaign
2021-10-13Publishedweakness classified, att&ck mapped

Affected products

Microsoft Corpcommercial · USaka Microsoft, microsoft corporation

And 65 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable