Loading story…
A public GitHub repository released a pure PowerShell exploit for CVE-2021-1675, a Windows Print Spooler flaw widely associated with PrintNightmare-style abuse. The proof of concept targets local privilege escalation, allowing an attacker to add a new local administrator account by default or load a custom DLL payload, and was reported as tested on Windows Server 2016 and Windows Server 2019. The implementation uses an embedded Base64-encoded, GZIP-compressed DLL and reflective Win32 API access techniques derived from PowerSploit/PowerUp.
Microsoft’s Security Update Guide identifies CVE-2021-1675 as a Windows Print Spooler vulnerability that was later clarified as a remote code execution issue, with a CVSS 7.8 rating and high impact to confidentiality, integrity, and availability. Microsoft also noted that PrintNightmare is tracked separately as CVE-2021-34527, even though the vulnerabilities are similar, underscoring confusion around spooler-related exploitation as public exploit code circulated alongside an official patch.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository published a native PowerShell implementation of the PrintNightmare local privilege escalation technique, branded around Invoke-Nightmare. The exploit abuses Windows Print Spooler functions and can add a local administrator account or load a custom DLL payload.
Microsoft released its Security Update Guide entry for CVE-2021-1675 covering a Windows Print Spooler vulnerability. The advisory indicated an official fix was available at original publication.
Microsoft updated the CVE-2021-1675 advisory with FAQ information and stated that the vulnerability publicly referred to as PrintNightmare is tracked as CVE-2021-34527, not CVE-2021-1675. The advisory said the two vulnerabilities are similar but distinct.
Microsoft issued an informational update correcting the CVE title and affected products table for CVE-2021-1675. The update changed the impact to Remote Code Execution and the severity to Critical.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An accidentally published proof-of-concept exploit exposed the Windows Print Spooler flaw known as **PrintNightmare**, showing that authenticated users could achieve remote code execution as `SYSTEM`, including on Active Directory domain controllers where the Print Spooler service was often enabled by default. The bug was tied to `CVE-2021-1675`, which Microsoft had initially treated as a privilege-escalation issue before reclassifying it as remote code execution, prompting warnings that ransomware operators could quickly weaponize the vulnerability and that even fully patched Windows Server 2019 domain controllers might remain at risk until a dedicated fix arrived. Microsoft responded with the `KB5004945` emergency security update for supported Windows versions, but the patch caused widespread printer connectivity failures, with Zebra label printers among the most visible affected devices and reports indicating other brands were also impacted. Microsoft acknowledged the printing issue as a known problem and advised affected users to either remove the update or reinstall printers with administrative credentials, while earlier mitigation guidance for the underlying threat had urged organizations to disable the Print Spooler service on domain controllers and other critical servers until a more complete remediation was available.
Jun 29, 2026
Kaspersky detailed **Operation PowerFall**, an attack chain that used the Windows elevation-of-privilege zero-day **`CVE-2020-0986`** together with an Internet Explorer 11 remote code execution exploit to break out of the browser sandbox. The flaw was traced to the GDI Print/Print Spooler API, where attacker-controlled request data reached `gdi32full.dll`’s `GdiPrinterThunk` handler for `INDEX_DocumentEvent` and enabled an arbitrary pointer dereference. By abusing that path, attackers manipulated memory in `splwow64.exe`, turning browser compromise into code execution in a medium-integrity process. The exploit reconstructed an encoded function pointer and overwrote `fpDocumentEvent` with an encoded `LoadLibraryA` pointer, then triggered library loading to execute attacker code. Microsoft’s pointer-encoding mechanism, documented through the Windows **`EncodePointer`** API, was part of the exploitation chain because the attackers had to recover and reuse encoded values correctly. Kaspersky said the bug closely resembled the earlier in-the-wild zero-day **`CVE-2019-0880`**, describing both as variants in the same vulnerable code path, while Microsoft’s fix tightened printer command validation and handle lookup logic in `splwow64.exe` to make `OutputBuf`-based exploitation far more difficult.
Aug 14, 2026
A public proof-of-concept exploit has been released for **CVE-2026-42980**, a high-severity Windows NT OS Kernel elevation-of-privilege flaw that allows a locally authenticated low-privileged user to gain **`NT AUTHORITY\SYSTEM`** access. The vulnerability stems from an integer underflow in the kernel's WMI serialization code that can trigger a heap-based buffer overflow and kernel memory corruption on supported Windows client and server releases, including Windows 10 Version 1607 and later builds. Microsoft patched the issue in its June 2026 Patch Tuesday updates, assigned it a **CVSS 3.1 score of `7.8`**, and assessed exploitation as **"more likely."** While there is no confirmed in-the-wild exploitation reported so far, the availability of exploit code raises the risk that attackers could use the bug after initial compromise to obtain full machine control, particularly on shared systems and servers. Microsoft has not provided a configuration workaround, making prompt deployment and validation of the June 2026 cumulative updates the primary mitigation.
Jul 23, 2026