VulnRadar

Data against noise.

Page generated: 09 Nov 2026, 11:51 UTC

CVE-2021-36934

Read full description

An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.

CVSS 7.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.5/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 7.8: +1.17
Fresh EPSS: 67.25%: +0.34

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 10 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Rapid7

Press · 11 Aug 2021, 07:00 · Patch Tuesday - August 2021 - Rapid7

SOC Prime

Press · 28 Jul 2021, 07:00 · PetitPotam NTLM Relay Attack Detection - SOC Prime

The Hacker News

Press · 26 Jul 2021, 07:00 · How to Mitigate Microsoft Windows 10, 11 SeriousSAM Vulnerability - The Hacker News

Tech Times

Press · 23 Jul 2021, 07:00 · How To Fix Windows 11 Hello Face Camera: Microsoft Releases Build 22000.100 Fixes But Some Issues are Still Active - Tech Times

Sophos

Press · 22 Jul 2021, 07:00 · HiveNightmare aka SeriousSAM vulnerability : what to do - Sophos

See all 10 source documents

Cyberint

Press · 22 Jul 2021, 07:00 · HiveNightmare / SeriousSAM (CVE-2021-36934) - Cyberint

SOC Prime

Press · 21 Jul 2021, 07:00 · Detect HiveNightmare (CVE-2021-36934) Exploitation Attempts - SOC Prime

Rapid7

Press · 21 Jul 2021, 07:00 · Microsoft SAM File Readability CVE-2021-36934: What You Need to Know - Rapid7

DoublePulsar

Press · 20 Jul 2021, 07:00 · #HiveNightmare aka #SeriousSAM — anybody can read the registry in Windows 10 - DoublePulsar

SentinelOne

Press · 20 Jul 2021, 07:00 · HiveNightmare | Protecting Windows 10 SAM from CVE-2021-36934 - SentinelOne

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.5 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

See 7 repos with metrics

Repository	Stars	Forks	Language	Updated
WiredPulse/Invoke-HiveNightmare	35	16	PowerShell	24 Sep 2022, 20:40
Wh04m1001/VSSCopy	8	5	C++	22 Jul 2021, 02:15
Sp00kySkelet0n/PyNightmare	7	1	Python	25 Jul 2021, 01:19
Preventions/CVE-2021-36934	3	59	—	24 Jul 2021, 13:01
grishinpv/poc_CVE-2021-36934	2	1	C++	02 Aug 2021, 13:52
OlivierLaflamme/CVE-2021-36934-export-shadow-volume-POC	1	0	C#	10 Aug 2021, 19:43
P1rat3R00t/Why-so-Serious-SAM	0	1	—	09 Jun 2025, 00:21

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 7.8; EPSS 67.3%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: local access, low privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:58:28.999775+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

20 Jul 2021, 07:00

Published

22 Jul 2021, 07:05

Latest press mention

11 Aug 2021, 07:00

Added to the CISA KEV catalog

10 Feb 2022, 00:00

Score calculated

05 Nov 2026, 13:58

PoCs on GitHub

7 repositories