Security News > 2021 > July > Microsoft shares workarounds for new Windows 10 zero-day bug
Microsoft has shared a workaround for a Windows 10 zero-day vulnerability that can let attackers gain admin rights on vulnerable systems and execute arbitrary code with SYSTEM privileges.
"An elevation of privilege vulnerability exists because of overly permissive Access Control Lists on multiple system files, including the Security Accounts Manager database," Microsoft explains in a security advisory published on Tuesday evening.
As Microsoft further revealed, this zero-day vulnerability impacts all Windows client and server versions released during the last three years, since October 2018, starting with Windows 10 1809 and Windows Server 2019.
Microsoft recommends restricting access to the problematic folder AND deleting Volume Shadow Copy Service shadow copies to mitigate this issue.
Microsoft is still investigating the vulnerability and is working on a patch that will most likely be released as an out-of-band security update later this week.
Update: Added more info on affected Windows versions, deleting shadow copies.
News URL
Related news
- Microsoft to force install new Outlook on Windows 10 PCs in February (source)
- Microsoft fixes actively exploited Windows Hyper-V zero-day flaws (source)
- Microsoft ends support for Office apps on Windows 10 in October (source)
- Windows 10 KB5051974 update force installs new Microsoft Outlook app (source)
- Windows 10 users urged to upgrade to avoid "security fiasco" (source)
- Microsoft may have scrapped Windows 11's dynamic wallpapers feature (source)
- Microsoft 365 apps crash on Windows Server after Office update (source)
- Microsoft January 2025 Patch Tuesday fixes 8 zero-days, 159 flaws (source)
- Windows 10 KB5049981 update released with new BYOVD blocklist (source)
- 3 Actively Exploited Zero-Day Flaws Patched in Microsoft's Latest Security Update (source)