CVE-2021-43226 – Windows CLFS Driver Privilege Escalation – What You Need to Do

What breaks and who should care

If your organisation runs any supported edition of Windows, you need to know about CVE-2021-43226. The flaw lives in the Common Log File System (CLFS) driver – a core component that handles structured logging for many Windows services. An attacker who already has a foothold on a machine can use this vulnerability to elevate their privileges and bypass security controls. That means ransomware groups, nation‑state actors, or any malicious insider could move from a low‑privilege account to SYSTEM level.

Related remediation guides

Other vulnerabilities in the same family or affecting the same products:

• CVE-2024-49039 – Windows Task Scheduler privilege escalation fix guide
• CVE-2025-29824 – Windows CLFS driver privilege‑escalation – what you need to know
• CVE-2026-61511 – Immediate guide for vBulletin admins

For the wider picture, our Known Exploited Vulnerabilities tracker lists every flaw CISA has confirmed under active attack.

Why the vulnerability matters

The CVSS base score is 7.8, placing it firmly in the high severity band. The United States Cybersecurity and Infrastructure Security Agency (CISA) has listed it in the Known Exploited Vulnerabilities catalog, confirming that active exploitation has been observed in the wild. Ransomware campaigns have specifically used this bug to encrypt data after gaining administrative rights.

Technical details – what actually happens

At a high level, the CLFS driver manages log files that multiple processes write to concurrently. The driver trusts certain internal data structures to enforce access checks. The flaw is a privilege‑escalation bug: a local attacker can manipulate those structures in a way that the kernel mis‑interprets, allowing the attacker to bypass the usual security checks and execute code with SYSTEM privileges.

The exact manipulation technique is not publicly disclosed – Microsoft’s advisory does not detail the exploit primitive. What we do know is that the vulnerability stems from insufficient validation of input that the driver receives from user‑mode components. By supplying crafted data, an attacker can corrupt the driver’s internal state and trigger an escalation path.

Because the CLFS driver is loaded early in the boot process and runs in kernel mode, any successful exploitation gives the attacker full control over the host. That is why the impact is described as a bypass of “certain security mechanisms” – essentially, the attacker can sidestep User Account Control, token restrictions, and any software‑based confinement that relies on standard privilege checks.

How to determine if you are exposed

The first step is to verify which Windows build you are running. Open a PowerShell window and run one of the following commands:

• systeminfo | findstr /B /C:"OS Version"
• (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuild
• winver (this launches a GUI dialog showing the version)

Compare the output against the table below. If your build appears in the “affected” column, you are vulnerable until you apply the appropriate patch.

Mitigation and patch – what you need to do right now

The vendor has released a fix for every affected branch. The remediation is straightforward: install the latest cumulative update for your Windows edition. In practice this means running Windows Update and ensuring that the most recent security roll‑up is applied.

If you manage updates centrally – for example via WSUS, Microsoft Endpoint Configuration Manager, or a third‑party patch‑management solution – make sure the update that contains the CLFS driver fix is approved and deployed to all machines in the affected scope. The update is identified by Microsoft as the security patch that addresses the CLFS privilege‑escalation issue.

After the update is installed, reboot the machine to load the patched driver. Verify the patch is present by re‑running the version‑check commands above; the build number should now appear in the “fixed” column of the table.

For environments that cannot tolerate an immediate reboot, you can use the shutdown /r /t 0 command to schedule a restart at a convenient maintenance window. Remember, the vulnerability is kernel‑level – until the driver is reloaded from the patched binaries, the system remains at risk.

If a patch is unavailable or you need a temporary defence

In rare cases an organisation may be stuck on an older branch that cannot receive the fix (for example, legacy systems that are out of support). CISA’s guidance for such scenarios is to apply mitigations and consider de‑commissioning the affected product.

Mitigation options include:

• Restrict local logon rights: ensure only trusted administrators have interactive logon privileges.
• Enable Device Guard or Credential Guard where possible – these features add additional isolation that can make kernel‑level exploits harder to exploit.
• Deploy application‑whitelisting (e.g. Windows Defender Application Control) to block unapproved binaries from executing, reducing the chance that a post‑exploitation payload can run.
• Monitor for suspicious activity: create alerts for unexpected creation of CLFS log files or abnormal token changes using Windows Event Forwarding or a SIEM.

These steps do not eliminate the vulnerability, but they raise the bar for an attacker and may give you time to plan a migration or upgrade path.

When to consider de‑commissioning

If you are unable to apply the patch and cannot implement the mitigations listed above, the safest route is to retire the affected system. Move workloads to a supported platform that receives regular security updates. This is especially important for servers that host sensitive data or are exposed to the internet.

What to do after you patch

Once the update is installed, run a full system scan with your endpoint protection solution. Look for indicators of compromise that might suggest an attacker tried to exploit the vulnerability before you patched. Typical signs include:

• Unexpected SYSTEM‑level processes launching from user directories.
• New scheduled tasks or services that run with high privileges.
• Changes to ACLs on log files that were previously restricted.

If you see any of these, treat the host as potentially compromised and follow your incident‑response playbook – isolate the machine, collect forensic evidence, and consider a full rebuild.

References and further reading

• Microsoft Security Advisory – details of the CLFS driver fix.
• CISA Known Exploited Vulnerabilities catalog – entry for CVE-2021-43226.
• Microsoft Update Catalog – locate the cumulative update for your branch.

Summary

CVE-2021-43226 is a high‑severity, kernel‑level privilege escalation flaw in the Windows Common Log File System driver. It has been confirmed exploited in ransomware attacks, and CISA has flagged it as a priority. Determine your exposure by checking the OS build, then apply the latest cumulative update for your Windows branch. If you cannot patch immediately, restrict local logons, enable advanced security features, and monitor for signs of abuse. In the worst case, retire the vulnerable system. Acting quickly will close the attack path and protect your environment from further compromise.

Version table

The table below lists the affected and fixed builds for each Windows release. Use it as a reference after you have run the version‑check commands.

Affected versions

Straight from the NVD record for CVE-2021-43226. If your build is inside one of these ranges, treat it as vulnerable.

Product	Affected range	Fixed in
windows_10_1507	* up to 10.0.10240.19145	10.0.10240.19145
windows_10_1607	* up to 10.0.14393.4825	10.0.14393.4825
windows_10_1809	* up to 10.0.17763.2366	10.0.17763.2366
windows_10_1909	* up to 10.0.18363.1977	10.0.18363.1977
windows_10_2004	* up to 10.0.19041.1415	10.0.19041.1415
windows_10_20h2	* up to 10.0.19042.1415	10.0.19042.1415
windows_10_21h1	* up to 10.0.19043.1415	10.0.19043.1415
windows_10_21h2	* up to 10.0.19044.1415	10.0.19044.1415
windows_11_21h2	* up to 10.0.22000.376	10.0.22000.376
windows_server_2004	* up to 10.0.19041.1415	10.0.19041.1415
windows_server_2016	* up to 10.0.14393.4825	10.0.14393.4825
windows_server_2019	* up to 10.0.17763.2366	10.0.17763.2366