CVE-2021-41366: Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability

CVE-2021-41366 is an elevation of privilege vulnerability in Credential Security Support Provider Protocol (CredSSP), rated Important by Microsoft, with a CVSS 3.1 base score of 7.8 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.49% probability of exploitation activity in the next 30 days, higher than 43% of all scored vulnerabilities. Microsoft released the fix on 8 November 2021 in the November 2021 Patch Tuesday, delivered through 11 security updates (KB5007206, KB5007189, KB5007186, KB5007205 and more). It affects 35 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2021-41366

Severity

High CVSS 7.8

Microsoft severity

Important

Impact

Elevation of Privilege

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

Less Likely

Weakness

CWE-269

EPSS

0.49% (percentile 43%)

CISA KEV

Not listed

Released

8 November 2021

Last updated

8 November 2021

Patch Tuesday

November 2021 Patch Tuesday

Product families

Windows, ESU

CVSS score and vector

Microsoft scores CVE-2021-41366 at 7.8 (temporal 6.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Affected products (35)

Windows

ESU

Security updates (11)

• KB5007206 (Security Update)
• KB5007189 (Security Update)
• KB5007186 (Security Update)
• KB5007205 (Security Update)
• KB5007215 (Security Update)
• KB5007207 (Security Update)
• KB5007192 (Security Update)
• KB5007247 (Monthly Rollup)
• KB5007255 (Security Only)
• KB5007260 (Monthly Rollup)
• KB5007245 (Security Only)

NIST NVD data

NVD status

Modified

NVD CVSS

7.8 (HIGH)

NVD weakness

CWE-269

Published to NVD

10 November 2021

NVD last modified

19 August 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41366
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41366 (Patch, Vendor Advisory)

Acknowledgments

• Xuefeng Li and Zhiniang Peng with Sangfor

Revision history

Related vulnerabilities

Other Credential Security Support Provider Protocol (CredSSP) vulnerabilities

• CVE-2025-47987: Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability (High, CVSS 7.8, July 2025)

More from the November 2021 Patch Tuesday

• CVE-2021-38666: Remote Desktop Client Remote Code Execution Vulnerability (High, CVSS 8.8)
• CVE-2021-41356: Windows Denial of Service Vulnerability (High, CVSS 7.5)
• CVE-2021-43211: Windows 10 Update Assistant Elevation of Privilege Vulnerability (Medium, CVSS 5.5)
• CVE-2021-38631: Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (Medium, CVSS 4.4)
• CVE-2021-41371: Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (Medium, CVSS 4.4)
• CVE-2021-26443: Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability (Critical, CVSS 9)
• CVE-2021-42275: Microsoft COM for Windows Remote Code Execution Vulnerability (High, CVSS 8.8)
• CVE-2021-42283: NTFS Elevation of Privilege Vulnerability (High, CVSS 8.8)
• CVE-2021-36957: Windows Desktop Bridge Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2021-41367: NTFS Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2021-41370: NTFS Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2021-41377: Windows Fast FAT File System Driver Elevation of Privilege Vulnerability (High, CVSS 7.8)

All vulnerabilities of this release: November 2021 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2021-41366
• NIST NVD: CVE-2021-41366
• CVE.org record: CVE-2021-41366