An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Account Manager (SAM) database.

An attacker could exploit this vulnerability (CVE-2021-36934) to gain elevated privileges. An attacker with low level privileges would need to take advantage of the incorrect permissions set on the SYSTEM and SAM hives.

To read and copy files from the hives an attacker would need to use Volume Shadow Copy (VSS) to extract NTLM hashed passwords. The attacker could use these hashes in further attacks, such as a pass-the-hash or Silver Ticket attack.

Proof-of-concept code (PoC) is publicly available. This vulnerability is being referred to as 'HiveNightmare' and 'SeriousSAM.'

Organizations are encouraged to check the Product(s) used in their environment and apply the workaround as soon as possible.