ZeroDay Findings
Sign inSign up

Findings

CVE-2021-36942

Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability

Published Aug 12, 2021 · updated Aug 10, 2026 · microsoft windows server 2004

Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 12, 2021 · Catalog

    Detected

    Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Nov 17, 2021 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Aug 10, 2026 · Catalog

    Updated

    Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.

Required action

Apply updates per vendor instructions.

CISA due date Nov 17, 2021

Affected

  • cpe microsoft/windows server 2004version unspecified
  • cpe microsoft/windows server 2008version unspecified
  • cpe microsoft/windows server 2008r2
  • cpe microsoft/windows server 2012version unspecified
  • cpe microsoft/windows server 2012r2
  • cpe microsoft/windows server 2016version unspecified
  • cpe microsoft/windows server 2019version unspecified
  • cpe microsoft/windows server 20h2version unspecified
  • vendor Microsoft Windowsversion unspecified

Sources

  • CISA KEVCVE-2021-36942

    Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.

    cisa.gov
  • CVE.orgCVE-2021-36942

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-36942

    30-day exploitation probability 66.0%

    first.org
  • Metasploit Modulesauxiliary_scanner/dcerpc/petitpotam

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2021-36942

    Windows LSA Spoofing Vulnerability

    nvd.nist.gov

References