CVE-2021-1675

ENISA EUVD: EUVD-2021-7142 ↗

Exploited in the Wild ✓ Confirmed 0-Day

Triaged: March 5, 2026 10 articles Published: 2021-06-08

VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-23

94.31%

probability

This CVE has a 94.31% probability of being exploited in the next 30 days.

0% Top 100.0th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)

7.8

HIGH

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Temporal

Exploit Code Maturity

Unproven

Remediation Level

Official Fix

Report Confidence

Confirmed

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CVSS v2 (legacy)

9.3

HIGH

Access Vector

Network

Access Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

AV:N/AC:M/Au:N/C:C/I:C/A:C

Description

NVD

Windows Print Spooler Remote Code Execution Vulnerability

Affected Products

Microsoft

Windows 10 Version 1809

10.0.0

Microsoft

Windows Server 2019

10.0.0

Microsoft

Windows Server 2019 (Server Core installation)

10.0.0

Microsoft

Windows 10 Version 1909

10.0.0

Microsoft

Windows 10 Version 21H1

10.0.0

microsoft

windows 10 1507

microsoft

windows 10 1607

microsoft

windows 10 1809

microsoft

windows 10 1909

microsoft

windows 10 2004

Microsoft

Windows Server 2008 Service Pack 2 (Server Core installation)

6.0.0 <6.0.6003.21137

Microsoft

Windows 10 Version 1909

10.0.0 <10.0.18363.1621

Microsoft

Windows Server 2019

10.0.0 <10.0.17763.1999

Microsoft

Windows Server 2012 R2

6.3.0 <6.3.9600.20045

Microsoft

Windows 10 Version 2004

10.0.0 <10.0.19041.1052

Microsoft

Windows Server version 2004

10.0.0 <10.0.19041.1052

Microsoft

Windows 7

6.1.0 <6.1.7601.25632

Microsoft

Windows Server 2012 R2 (Server Core installation)

6.3.0 <6.3.9600.20044

Microsoft

Windows Server 2012 R2 (Server Core installation)

6.3.0 <6.3.9600.20045

Microsoft

Windows 10 Version 1809

10.0.0 <10.0.17763.1999

Microsoft

Windows Server 2008 Service Pack 2

6.0.0 <6.0.6003.21137

Microsoft

Windows Server 2012 (Server Core installation)

6.2.0 <6.2.9200.23372

Microsoft

Windows 10 Version 21H1

10.0.0 <10.0.19043.1052

Microsoft

Windows 10 Version 1607

10.0.0 <10.0.14393.4467

Microsoft

Windows Server 2016

10.0.0 <10.0.14393.4467

Microsoft

Windows 8.1

6.3.0 <6.3.9600.20045

Microsoft

Windows 7 Service Pack 1

6.1.0 <6.1.7601.25632

Microsoft

Windows 10 Version 20H2

10.0.0 <10.0.19042.1052

Microsoft

Windows Server 2012

6.2.0 <6.2.9200.23372

Microsoft

Windows 8.1

6.3.0 <6.3.9600.20044

Microsoft

Windows Server 2008 R2 Service Pack 1 (Server Core installation)

6.0.0 <6.1.7601.25632

Microsoft

Windows Server 2008 R2 Service Pack 1

6.1.0 <6.1.7601.25632

Microsoft

Windows Server 2016 (Server Core installation)

10.0.0 <10.0.14393.4467

Microsoft

Windows Server 2012 R2

6.3.0 <6.3.9600.20044

Microsoft

Windows Server 2008 Service Pack 2

6.0.0 <6.0.6003.21137

Microsoft

Windows Server 2019 (Server Core installation)

10.0.0 <10.0.17763.1999

Microsoft

Windows Server version 20H2

10.0.0 <10.0.19042.1052

Microsoft

Windows 10 Version 1507

10.0.0 <10.0.10240.18967

Exploits & PoC

cube0x0/CVE-2021-1675

C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527

1983 2021-07-20

calebstewart/CVE-2021-1675

Pure PowerShell implementation of CVE-2021-1675 Print Spooler Local Privilege Escalation (PrintNightmare)

1099 2021-07-05

hlldz/CVE-2021-1675-LPE

Local Privilege Escalation Edition for CVE-2021-1675/CVE-2021-34527

324 2021-07-05

LaresLLC/CVE-2021-1675

CVE-2021-1675 Detection Info

214 2023-05-20

ly4k/PrintNightmare

Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527)

208 2021-10-17

mstxq17/CVE-2021-1675_RDL_LPE

PrintNightMare LPE提权漏洞的CS 反射加载插件。开箱即用、通过内存加载、混淆加载的驱动名称来ByPass Defender/EDR。

145 2021-09-01

sailay1996/PrintNightmare-LPE

CVE-2021-1675 (PrintNightmare)

77 2021-07-05

evilashz/CVE-2021-1675-LPE-EXP

PrintNightmare , Local Privilege Escalation of CVE-2021-1675 or CVE-2021-34527

56 2021-07-02

cybersecurityworks553/CVE-2021-1675_PrintNightMare

23 2021-11-18

JumpsecLabs/PrintNightmare

Information on the Windows Spooler vulnerability - CVE-2021-1675; CVE 2021 34527

19 2021-07-12

eversinc33/NimNightmare

CVE-2021-1675 LPE PoC in Nim (PrintNightmare Local Privilege Escalation)

18 2021-12-05

k8gege/cve-2021-1675

15 2021-07-11

Wra7h/SharpPN

C# PrintNightmare (CVE-2021-1675)

10 2021-09-26

Leonidus0x10/CVE-2021-1675-SCANNER

Vulnerability Scanner for CVE-2021-1675/PrintNightmare

9 2021-07-02

corelight/CVE-2021-1675

9 2024-09-03

exploitblizzard/PrintNightmare-CVE-2021-1675

Youtube : https://youtu.be/Zr0KjYDSFKQ

5 2021-07-04

thomasgeens/CVE-2021-1675

3 2021-07-02

hahaleyile/my-CVE-2021-1675

see https://github.com/cube0x0/CVE-2021-1675

3 2021-08-13

yu2u/CVE-2021-1675

CVE-2021-1675 exploit

2 2021-06-29

kondah/patch-cve-2021-1675

2 2021-06-30

killtr0/CVE-2021-1675-PrintNightmare

2 2021-07-02

ozergoker/PrintNightmare

Windows Print Spooler Service RCE CVE-2021-1675 (PrintNightmare)

2 2021-07-03

bartimusprimed/CVE-2021-1675-Yara

2 2021-07-08

puckiestyle/CVE-2021-1675

1 2021-10-31

Winter3un/CVE-2021-1675

1 2021-07-20

OppressionBreedsResistance/CVE-2021-1675-PrintNightmare

Working PowerShell POC

1 2021-10-06

peckre/PNCVE-Win10-20H2-Exploit

A one-click script to gain a System privileges command line in Windows 10 20H2 that exploits CVE-2021-1675

1 2024-01-17

whoami-chmod777/CVE-2021-1675-CVE-2021-34527

1 2024-02-12

DLL00P/CVE-2021-1675

1 2025-07-29

tanarchytan/CVE-2021-1675

Fix without disabling Print Spooler

0 2021-07-02

mrezqi/CVE-2021-1675_CarbonBlack_HuntingQuery

0 2021-07-02

kougyokugentou/CVE-2021-1675

A small powershell script to disable print spooler service using desired state configuration

0 2021-07-02

ptter23/CVE-2021-1675

CVE-2021-1675: ZERO-DAY VULNERABILITY IN WINDOWS PRINTER SERVICE WITH AN EXPLOIT AVAILABLE IN ALL OPERATING SYSTEM VERSIONS

0 2021-07-02

initconf/cve-2021-1675-printnightmare

to catch cve-2021-1675-printnightmare

0 2021-07-03

edsonjt81/CVE-2021-1675

0 2022-12-27

galoget/PrintNightmare-CVE-2021-1675-CVE-2021-34527

CVE-2021-1675 / CVE-2021-34527 - PrintNightmare Python, C# and PowerShell Exploits Implementations (LPE & RCE)

0 2021-07-12

thalpius/microsoft-cve-2021-1675

0 2024-05-27

zha0/Microsoft-CVE-2021-1675

0 2021-07-18

r1skkam/PrintNightmare

Learn about the vulnerability known as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527)

0 2022-12-29

000Tonio/cve-2021-1675

0 2022-11-07

whoami-chmod777/CVE-2021-1675---PrintNightmare-LPE-PowerShell-

0 2024-02-12

0xSs0rZ/Windows_Exploit

CVE-2021-1675/CVE-2021-34527 PrintNightmare & CVE-2020-0668

0 2024-06-05

Sp4ceDogy/NPE-CS-V-CVE-2021-1675

0 2025-03-10

CameraShutterBug/PrintNightmare

C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527

0 2025-07-24

ccordeiro/CVE-2021-1675

C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527

0 2025-11-19

45 repos — triés par ⭐ Rechercher sur GitHub ↗

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1675

x_refsource_MISC

https://www.kb.cert.org/vuls/id/383432

third-party-advisory x_refsource_CERT-VN

http://packetstormsecurity.com/files/163349/Microsoft-PrintNightmare-Proof-Of-Concept.html

x_refsource_MISC

http://packetstormsecurity.com/files/163351/PrintNightmare-Windows-Spooler-Service-Remote-Code-Execution.html

x_refsource_MISC

http://packetstormsecurity.com/files/167261/Print-Spooler-Remote-DLL-Injection.html

x_refsource_MISC

Signal Intelligence

Confidenceⓘ

75%

EPSS 94.31%

CVSS v3.1 7.8

Mentions 10

Last Seen Nov 09, 2021

CNA Information

CNA Assigner

microsoft

CNA Title

Windows Print Spooler Remote Code Execution Vulnerability

Analyst Note

CVE-2021-1675 is the PrintNightmare Windows Print Spooler RCE vulnerability. Published June 8, 2021, it was actively exploited in the wild before Microsoft released patches on June 8 and subsequent updates. The vulnerability became widely documented as a zero-day with proof-of-concept exploitation occurring before official patches were fully deployed, meeting the core zero-day criteria despite limited article coverage in this dataset.