CVE-2021-33786

HighCVSS 8.1/10Last modified Aug 10, 2026

Description

Windows LSA Security Feature Bypass Vulnerability

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected software

VendorProductVersions
MicrosoftWindows Server 2008 R2 Service Pack 1>= 6.1.7601.0, < 6.1.7601.25661
MicrosoftWindows Server 2008 R2 Service Pack 1 (Server Core installation)>= 6.1.7601.0, < 6.1.7601.25661
MicrosoftWindows Server 2008 Service Pack 2>= 6.0.6003.0, < 6.0.6003.21167
MicrosoftWindows Server 2008 Service Pack 2 (Server Core installation)>= 6.0.6003.0, < 6.0.6003.21167
MicrosoftWindows Server 2012>= 6.2.9200.0, < 6.2.9200.23409
MicrosoftWindows Server 2012 (Server Core installation)>= 6.2.9200.0, < 6.2.9200.23409
MicrosoftWindows Server 2012 R2>= 6.3.9600.0, < 6.3.9600.20069
MicrosoftWindows Server 2012 R2 (Server Core installation)>= 6.3.9600.0, < 6.3.9600.20069
MicrosoftWindows Server 2016>= 10.0.14393.0, < 10.0.14393.4530
MicrosoftWindows Server 2016 (Server Core installation)>= 10.0.14393.0, < 10.0.14393.4530
MicrosoftWindows Server 2019>= 10.0.17763.0, < 10.0.17763.2061
MicrosoftWindows Server 2019 (Server Core installation)>= 10.0.17763.0, < 10.0.17763.2061
MicrosoftWindows Server version 2004>= 10.0.0, < 10.0.19041.1110
MicrosoftWindows Server version 20H2>= 10.0.0, < 10.0.19042.1110

References

Timeline

Published
Jul 14, 2021
Last modified
Aug 10, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-337887.5Windows LSA Denial of Service VulnerabilityCVE-2021-337909.8The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as pCVE-2021-337927.8Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write via a crafted /Size key in the Trailer dictionary.CVE-2021-337939.8Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write because the Cross-Reference table is mishandled during OCVE-2021-337949.1Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 allow information disclosure or an application crash after mishandling the Tab key dCVE-2021-337955.5Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 produce incorrect PDF document signatures because the certificate name, document ownCVE-2021-337967.5In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service.CVE-2021-337979.8Buffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1. An integer overflow happens when js_strtod() reads in floating pointCVE-2021-337986.5A null pointer dereference was found in libpano13, version libpano13-2.9.20. The flow allows attackers to cause a denial of service and poteCVE-2021-33806.5Insecure direct object reference (IDOR) vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print InvCVE-2021-338007.5In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.CVE-2021-338069.8The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted data in ObjectInputStrea
CVE-2021-33786: High severity, CVSS 8.1 | Vulnix