Loading story…
An accidentally published proof-of-concept exploit exposed the Windows Print Spooler flaw known as PrintNightmare, showing that authenticated users could achieve remote code execution as SYSTEM, including on Active Directory domain controllers where the Print Spooler service was often enabled by default. The bug was tied to CVE-2021-1675, which Microsoft had initially treated as a privilege-escalation issue before reclassifying it as remote code execution, prompting warnings that ransomware operators could quickly weaponize the vulnerability and that even fully patched Windows Server 2019 domain controllers might remain at risk until a dedicated fix arrived.
Microsoft responded with the KB5004945 emergency security update for supported Windows versions, but the patch caused widespread printer connectivity failures, with Zebra label printers among the most visible affected devices and reports indicating other brands were also impacted. Microsoft acknowledged the printing issue as a known problem and advised affected users to either remove the update or reinstall printers with administrative credentials, while earlier mitigation guidance for the underlying threat had urged organizations to disable the Print Spooler service on domain controllers and other critical servers until a more complete remediation was available.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
By 2021-08-12, Cisco Talos reported that the Vice Society ransomware group was exploiting the PrintNightmare vulnerability to gain access during real-world attacks. The report marked a shift from vulnerability disclosure and patching to documented use by a named ransomware actor.
Microsoft published guidance for KB5005652 describing new default Point and Print driver installation behavior associated with CVE-2021-34481. The advisory documented stricter administrative requirements for printer driver installation as part of Print Spooler security hardening.
On 2021-07-08, Microsoft recognized the printer breakage as a known issue and suggested rollback or reinstalling printers with administrative credentials, while Zebra said multiple brands were affected and that Microsoft planned an updated fix within one to two business days.
After users installed KB5004945, some systems lost the ability to connect to printers, with several Zebra label printer models specifically reported as affected.
By 2021-07-08, Microsoft had issued the KB5004945 security update to address the actively exploited PrintNightmare vulnerability across supported Windows versions.
By 2021-06-30, experts warned that fully patched Windows Server 2019 domain controllers could still be exploitable because the Print Spooler service was enabled by default, and advised disabling the service on critical systems.
Researchers at Sangfor Technologies mistakenly released proof-of-concept exploit code after believing the bug had been fixed, exposing details of the unpatched Print Spooler flaw later dubbed PrintNightmare.
On 2021-06-21, Microsoft updated its assessment of CVE-2021-1675 and reclassified the Print Spooler bug as a remote code execution vulnerability.
On 2021-06-08, Microsoft released a patch for CVE-2021-1675, initially describing the Windows Print Spooler issue as a local privilege-escalation vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
10 references tracked. Mallory keeps watching after this page renders.
support.microsoft.com
Open sourcegithub.com
Open sourceblog.talosintelligence.com
Open sourceindependent.co.uk
Open sourcebbc.com
Open sourceus-cert.cisa.gov
Open sourceforbes.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A public GitHub repository released a pure PowerShell exploit for **CVE-2021-1675**, a Windows Print Spooler flaw widely associated with **PrintNightmare**-style abuse. The proof of concept targets **local privilege escalation**, allowing an attacker to add a new local administrator account by default or load a custom DLL payload, and was reported as tested on **Windows Server 2016** and **Windows Server 2019**. The implementation uses an embedded Base64-encoded, GZIP-compressed DLL and reflective Win32 API access techniques derived from PowerSploit/PowerUp. Microsoft’s Security Update Guide identifies **CVE-2021-1675** as a Windows Print Spooler vulnerability that was later clarified as a **remote code execution** issue, with a **CVSS 7.8** rating and high impact to confidentiality, integrity, and availability. Microsoft also noted that **PrintNightmare** is tracked separately as **CVE-2021-34527**, even though the vulnerabilities are similar, underscoring confusion around spooler-related exploitation as public exploit code circulated alongside an official patch.
Aug 15, 2026
Kaspersky detailed **Operation PowerFall**, an attack chain that used the Windows elevation-of-privilege zero-day **`CVE-2020-0986`** together with an Internet Explorer 11 remote code execution exploit to break out of the browser sandbox. The flaw was traced to the GDI Print/Print Spooler API, where attacker-controlled request data reached `gdi32full.dll`’s `GdiPrinterThunk` handler for `INDEX_DocumentEvent` and enabled an arbitrary pointer dereference. By abusing that path, attackers manipulated memory in `splwow64.exe`, turning browser compromise into code execution in a medium-integrity process. The exploit reconstructed an encoded function pointer and overwrote `fpDocumentEvent` with an encoded `LoadLibraryA` pointer, then triggered library loading to execute attacker code. Microsoft’s pointer-encoding mechanism, documented through the Windows **`EncodePointer`** API, was part of the exploitation chain because the attackers had to recover and reuse encoded values correctly. Kaspersky said the bug closely resembled the earlier in-the-wild zero-day **`CVE-2019-0880`**, describing both as variants in the same vulnerable code path, while Microsoft’s fix tightened printer command validation and handle lookup logic in `splwow64.exe` to make `OutputBuf`-based exploitation far more difficult.
Aug 14, 2026
Microsoft published security advisories for a series of **Windows PrintWorkflowUserSvc Elevation of Privilege** vulnerabilities affecting the Windows printing workflow service. The issues were assigned multiple CVEs, including `CVE-2024-49095`, `CVE-2025-21235`, `CVE-2025-55331`, `CVE-2025-55684`, `CVE-2025-55685`, `CVE-2025-55686`, `CVE-2025-55688`, `CVE-2025-55689`, and `CVE-2025-55691`, indicating repeated security weaknesses in the same Windows component. The advisories provide limited public detail, but each entry classifies the issue as an **elevation of privilege** flaw in `PrintWorkflowUserSvc`, a service tied to Windows print processing. For defenders, the cluster signals that organizations running Windows endpoints and print-enabled systems should prioritize Microsoft security updates covering this service, review exposure across workstation and server fleets, and monitor for post-compromise activity that could indicate local privilege escalation through the printing stack.
Jul 12, 2026