CVE-2021-27070
published 2021-03-11CVE-2021-27070: Windows 10 Update Assistant Elevation of Privilege Vulnerability
PriorityP340high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
3.86%
89.4th percentile
Windows 10 Update Assistant Elevation of Privilege Vulnerability
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_version_2004 | >= 10.0.0 < 10.0.19043.867 | 10.0.19043.867 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19043.867 | 10.0.19043.867 |
| microsoft | windows_server_2016 | — | — |
| microsoft | windows_server_2016 | — | — |
| microsoft | windows_server_version_2004 | >= 10.0.0 < 10.0.19043.867 | 10.0.19043.867 |
| microsoft | windows_server_version_20h2 | >= 10.0.0 < 10.0.19043.867 | 10.0.19043.867 |
| msrc | windows_10_version_2004_for_32-bit_systems | — | — |
| msrc | windows_10_version_2004_for_arm64-based_systems | — | — |
| msrc | windows_10_version_2004_for_x64-based_systems | — | — |
| msrc | windows_10_version_20h2_for_32-bit_systems | — | — |
| msrc | windows_10_version_20h2_for_arm64-based_systems | — | — |
| msrc | windows_10_version_20h2_for_x64-based_systems | — | — |
| msrc | windows_server_version_2004 | — | — |
| msrc | windows_server_version_20h2 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_msrc7.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Microsoft Windows 10 20H2/10 2004/Server 20H2/Server 2004 Update Assistant privileges management
vuldb·2026-08-21·CVSS 7.8
CVE-2021-27070 [HIGH] Microsoft Windows 10 20H2/10 2004/Server 20H2/Server 2004 Update Assistant privileges management
A vulnerability was found in Microsoft Windows 10 2004/10 20H2/Server 2004/Server 20H2. It has been classified as critical. This vulnerability affects unknown code of the component Update Assistant. The manipulation leads to improper privilege management.
This vulnerability is uniquely identified as CVE-2021-27070. Local access is required to approach this attack. No exploit exists.
To fix this issue, it is recommended to deploy a patch.
GHSA
GHSA-323v-6736-wj2p: Windows 10 Update Assistant Elevation of Privilege Vulnerability
ghsa_unreviewed·2022-05-24
CVE-2021-27070 [HIGH] CWE-269 GHSA-323v-6736-wj2p: Windows 10 Update Assistant Elevation of Privilege Vulnerability
Windows 10 Update Assistant Elevation of Privilege Vulnerability
Microsoft
Windows 10 Update Assistant Elevation of Privilege Vulnerability
vendor_msrc·2021-03-09·CVSS 7.3
CVE-2021-27070 [HIGH] Windows 10 Update Assistant Elevation of Privilege Vulnerability
Windows 10 Update Assistant Elevation of Privilege Vulnerability
Windows Update Assistant: Windows Update Assistant
Microsoft: Microsoft
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:N/A
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5000802
Reference: https://support.microsoft.com/help/5000802
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-03-11
Published