Security News > 2021 > November > New Windows 10 zero-day gives admin rights, gets unofficial patch

Free unofficial patches have been released to protect Windows users from a local privilege escalation zero-day vulnerability in the Mobile Device Management Service impacting Windows 10, version 1809 and later.
While Microsoft has most likely also noticed Naceri's June disclosure, the company is yet to patch this LPE bug, exposing Windows 10 systems with the latest November 2021 security updates to attacks.
Unnoficial patches for all impacted Windows 10 systems.
"Windows 10 v1803 and older Windows 10 versions don't seem to be affected either. While they do have the 'Access work or school' functionality, it behaves differently and cannot be exploited this way. Windows 7 does not have the 'Access work or school' functionality at all."
This is the second Windows zero-day that received a micropatch this month after Naceri found that patches for another bug in the Windows User Profile Service could be bypassed to escalate privileges on all Windows versions, even if fully patched.
If successfully exploited, the zero-day allows attackers to gain SYSTEM privileges on up-to-date devices running the latest Windows versions, including Windows 10, Windows 11, and Windows Server 2022.
News URL
Related news
- Microsoft to force install new Outlook on Windows 10 PCs in February (source)
- Week in review: Exploited Ivanti Connect Secure zero-day, Patch Tuesday forecast (source)
- Microsoft January 2025 Patch Tuesday fixes 8 zero-days, 159 flaws (source)
- Windows 10 KB5049981 update released with new BYOVD blocklist (source)
- Microsoft fixes actively exploited Windows Hyper-V zero-day flaws (source)
- Microsoft ends support for Office apps on Windows 10 in October (source)
- Windows Patch Tuesday hits snag with Citrix software, workarounds published (source)
- 7-Zip fixes bug that bypasses Windows MoTW security warnings, patch now (source)
- Patch procrastination leaves 50,000 Fortinet firewalls vulnerable to zero-day (source)
- Windows 11 24H2 now also offered to all eligible Windows 10 PCs (source)