Coverage › CVE-2021-34527
CVE-2021-34527 Unmapped
Microsoft Windows Print Spooler Remote Code Execution Vulnerability
- Vendor / product
- Microsoft — Windows
- Description (CISA)
- Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.
- Added to KEV
- 2021-11-03
- Due date
- 2022-05-03
- Required action
- Apply updates per vendor instructions.
- Known ransomware use
- Known
- CWE
- CWE-269
- CISA notes
- Reference CISA's ED 21-04 (https://www.cisa.gov/news-events/directives/ed-21-04-mitigate-windows-print-spooler-service-vulnerability) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-04. https://nvd.nist.gov/vuln/detail/CVE-2021-34527
- Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques
No public source states how this vulnerability is exploited in ATT&CK terms.
The only authoritative CVE → ATT&CK mapping in the open — CTID's Mappings Explorer, pinned to a KEV snapshot of 2025-07-28 and ATT&CK 16.1 — does not include CVE-2021-34527.
CISA's catalogue carries no technique field. kevmap does not infer techniques from the CWE (CWE-269) — here is why — and does not guess.
This page will change state automatically if a mapping is published. What is shown above is everything CISA publishes about the entry.
Sigma rules tagged with this CVE
5 rules in SigmaHQ carry the tag cve.2021-34527. These are shown as detection content for the CVE itself. Their ATT&CK tags are deliberately not rendered here: a rule author's tag is not an authoritative statement of how the vulnerability is exploited, and this page does not show techniques for unmapped entries.
Author: FPT.EagleEye, Thomas Patzke (improvements)
· 2021-06-29 (modified 2022-06-02) · logsource: product=windows category=image_load · 02fb90de-c321-4e63-a6b9-25f4b03dfd14
Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).
CVE tags: CVE-2021-1675CVE-2021-34527
Author: Sittikorn S, Nuttakorn T, Tim Shelton
· 2021-07-01 (modified 2023-10-23) · logsource: category=antivirus · 6fe1719e-ecdf-4caf-bffe-4f501cb0a561
Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .
CVE tags: CVE-2021-34527CVE-2021-1675
Author: @neu5ron (Nate Guagenti)
· 2021-08-23 (modified 2025-11-03) · logsource: product=zeek service=dce_rpc · 7b33baef-2a75-4ca3-9da4-34f9a15382d8
Detects the remote installation of a print driver which is possible indication of the exploitation of PrintNightmare (CVE-2021-1675).
The occurrence of print drivers being installed remotely via RPC functions should be rare, as print drivers are normally installed locally and or through group policy.
CVE tags: CVE-2021-1678CVE-2021-1675CVE-2021-34527
Author: INIT_6
· 2021-07-02 (modified 2022-10-05) · logsource: product=windows service=security · 8fe1c584-ee61-444b-be21-e9054b229694
Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527
CVE tags: CVE-2021-1675CVE-2021-34527
Author: Markus Neis, @markus_neis, Florian Roth
· 2021-07-04 (modified 2023-06-12) · logsource: product=windows category=registry_event · ba6b9e43-1d45-4d3c-a504-1043a64c8469
Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527
CVE tags: CVE-2021-1675CVE-2021-34527