CVE-2021-43223: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

CVE-2021-43223 is an elevation of privilege vulnerability in Windows Remote Access Connection Manager, rated Important by Microsoft, with a CVSS 3.1 base score of 7.8 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.54% probability of exploitation activity in the next 30 days, higher than 46% of all scored vulnerabilities. Microsoft released the fix on 14 December 2021 in the December 2021 Patch Tuesday, delivered through 13 security updates (KB5008218, KB5008206, KB5008212, KB5008223 and more). It affects 38 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2021-43223

Severity

High CVSS 7.8

Microsoft severity

Important

Impact

Elevation of Privilege

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

Less Likely

EPSS

0.54% (percentile 46%)

CISA KEV

Not listed

Released

14 December 2021

Last updated

14 December 2021

Patch Tuesday

December 2021 Patch Tuesday

Product families

Windows, ESU

CVSS score and vector

Microsoft scores CVE-2021-43223 at 7.8 (temporal 6.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Affected products (38)

Windows

ESU

Security updates (13)

• KB5008218 (Security Update)
• KB5008206 (Security Update)
• KB5008212 (Security Update)
• KB5008223 (Security Update)
• KB5008215 (Security Update)
• KB5008230 (Security Update)
• KB5008207 (Security Update)
• KB5008244 (Monthly Rollup)
• KB5008282 (Security Only)
• KB5008263 (Monthly Rollup)
• KB5008285 (Security Only)
• KB5008277 (Monthly Rollup)
• KB5008255 (Security Only)

NIST NVD data

NVD status

Modified

NVD CVSS

7.8 (HIGH)

Published to NVD

15 December 2021

NVD last modified

17 June 2026

Affected configurations (CPE)

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43223 (Patch, Vendor Advisory)
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43223 (Patch, Vendor Advisory)

Acknowledgments

• Xuefeng Li and Zhiniang Peng with Sangfor

Revision history

Related vulnerabilities

Other Windows Remote Access Connection Manager vulnerabilities

• CVE-2026-85867: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (High, CVSS 7.8, October 2026)
• CVE-2026-70137: Windows Remote Access Connection Manager Information Disclosure Vulnerability (Medium, CVSS 5.5, October 2026)
• CVE-2026-71352: Windows Remote Access Connection Manager Remote Code Execution Vulnerability (High, CVSS 8.8, September 2026)
• CVE-2026-71343: Windows Remote Access Connection Manager Remote Code Execution Vulnerability (High, CVSS 7.8, September 2026)
• CVE-2026-71342: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (High, CVSS 7, September 2026)
• CVE-2026-71333: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (High, CVSS 7, September 2026)
• CVE-2026-69455: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (High, CVSS 7.8, September 2026)
• CVE-2026-69331: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (High, CVSS 7, September 2026)
• CVE-2026-72966: Windows Remote Access Connection Manager Tampering Vulnerability (Medium, CVSS 5.5, September 2026)
• CVE-2026-62783: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (High, CVSS 7.8, August 2026)
• CVE-2026-62758: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (High, CVSS 7.8, August 2026)
• CVE-2026-21525: Windows Remote Access Connection Manager Denial of Service Vulnerability (Medium, CVSS 6.2, exploited, February 2026)

More from the December 2021 Patch Tuesday

• CVE-2021-41333: Windows Print Spooler Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2021-43883: Windows Installer Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2021-43880: Windows Mobile Device Management Elevation of Privilege Vulnerability (Medium, CVSS 5.5)
• CVE-2021-43240: NTFS Set Short Name Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2021-43893: Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability (High, CVSS 7.5)
• CVE-2021-43215: iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution (Critical, CVSS 9.8)
• CVE-2021-43207: Windows Common Log File System Driver Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2021-43226: Windows Common Log File System Driver Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2021-43233: Remote Desktop Client Remote Code Execution Vulnerability (High, CVSS 7.5)
• CVE-2021-43217: Windows Encrypting File System (EFS) Remote Code Execution Vulnerability (High, CVSS 8.1)
• CVE-2021-40441: Windows Media Center Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2021-40452: HEVC Video Extensions Remote Code Execution Vulnerability (High, CVSS 7.8)

All vulnerabilities of this release: December 2021 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2021-43223
• NIST NVD: CVE-2021-43223
• CVE.org record: CVE-2021-43223