November 3, 2021 · Applied Cybernetics Group
CVE-2021-36948 Microsoft Windows
Microsoft Windows Update Medic Service Privilege Escalation Vulnerability
- Added to KEV
2021-11-03- Federal due date
2021-11-17- Vendor
- Microsoft
- Product
- Windows
- EPSS
- 97.8th percentile (score 0.233, as of
2026-11-06) - NVD CVSS v3.1
- 7.8 (HIGH)
- Ransomware use
- Unknown
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2021-36948
CISA short description
Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation.
Required action
Apply updates per vendor instructions.
NVD description
Windows Update Medic Service Elevation of Privilege Vulnerability