CVE-2021-33779
published 2021-07-14CVE-2021-33779: Windows AD FS Security Feature Bypass Vulnerability
PriorityP337medium6.5CVSS 3.1
AVNACLPRHUINSUCHIHAN
EPSS
2.44%
84.2th percentile
Windows AD FS Security Feature Bypass Vulnerability
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_server_2016 | — | — |
| microsoft | windows_server_2016 | — | — |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.4530 | 10.0.14393.4530 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.2061 | 10.0.17763.2061 |
| microsoft | windows_server_version_2004 | >= 10.0.0 < 10.0.19041.1110 | 10.0.19041.1110 |
| microsoft | windows_server_version_20h2 | >= 10.0.0 < 10.0.19042.1110 | 10.0.19042.1110 |
| msrc | windows_server_2016 | — | — |
| msrc | windows_server_2019 | — | — |
| msrc | windows_server_version_2004 | — | — |
| msrc | windows_server_version_20h2 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
vendor_msrc8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Microsoft Windows Server 20H2/Server 2004/Server 2016/Server 2019 ADFS Security Feature
vuldb·2026-08-11·CVSS 6.5
CVE-2021-33779 [MEDIUM] Microsoft Windows Server 20H2/Server 2004/Server 2016/Server 2019 ADFS Security Feature
A vulnerability labeled as critical has been found in Microsoft Windows Server 2016/Server 2019/Server 2004/Server 20H2. This affects an unknown function of the component ADFS Security Feature. Such manipulation leads to an unknown weakness.
This vulnerability is listed as CVE-2021-33779. The attack may be performed from remote. There is no available exploit.
A patch should be applied to remediate this issue.
GHSA
GHSA-jgpr-7x8j-xjhf: Windows ADFS Security Feature Bypass Vulnerability
ghsa_unreviewed·2022-05-24
CVE-2021-33779 [MEDIUM] GHSA-jgpr-7x8j-xjhf: Windows ADFS Security Feature Bypass Vulnerability
Windows ADFS Security Feature Bypass Vulnerability
Microsoft
Windows AD FS Security Feature Bypass Vulnerability
vendor_msrc·2021-07-13·CVSS 8.1
CVE-2021-33779 [HIGH] Windows AD FS Security Feature Bypass Vulnerability
Windows AD FS Security Feature Bypass Vulnerability
FAQ: What kind of security feature could be bypassed by successfully exploiting this vulnerability?
This vulnerability relates to Primary Refresh Tokens which are usually stored in TPM. These tokens are usually used for SSO for Azure AD accounts. The tokens are not encrypted in a strong enough manner, and an administrator with access to a vulnerable system could extract and potentially decrypt the token for reuse until the token expires or is renewed.
Active Directory Federation Services: Active Directory Federation Services
Microsoft: Microsoft
Impact: Security Feature Bypass
Exploit Status: Publicly Disclosed:Yes;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:N/A
R
No detection rules found.
No public exploits indexed.
Crowdstrike
July 2021 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] July 2021 Patch Tuesday: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
Crowdstrike
July 2021 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] July 2021 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
2021-07-14
Published