Windows'PrintNightmare' vulnerability being actively exploited by attackers

A Windows vulnerability appears to have accidentally been shared by researchers, and it's actively being exploited.

What you need to know

• A vulnerability dubbed "PrintNightmare" allows attackers to "install programs; view, change, or delete data; or create new accounts with full user rights," according to Microsoft.
• Researchers appear to have accidentally shared the vulnerability publicly.
• Attackers can utilize the vulnerability to target the Windows Print Spooler service.

The Windows Print Spooler service has an unpatched critical flaw that's been dubbed "PrintNightmare." Microsoft warns people about the vulnerability and breaks down how it works in a recent post:

"A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations," says the company. "An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights."

According to Microsoft, the vulnerability is being actively exploited.

The vulnerability appears to have been accidently published in the form of a proof-of-concept exploit. Sangfor researchers published the proof-of-concept but have since deleted it. Unfortunately, the code was forked on GitHub before it was removed.

As explained by The Verge, the researchers at Sangfor appeared to have thought the vulnerability had been patched by Microsoft. The company had patched issues related to Windows Print Spooler, but they were not for this specific issue.

Microsoft lists two options as workarounds for the issue:

1. Disable the Print Spooler service
2. Disable inbound remote printing through Group Policy

While publicly known as PrintNightmare, Microsoft has assigned the name CVE-2021-34527 to the vulnerability.

Microsoft is still investigating the severity of this vulnerability. The company is also investigating if all versions of Windows are exploitable.

"The code that contains the vulnerability is in all versions of Windows," says Microsoft. "We are still investigating whether all versions are exploitable. We will update this CVE when that information is evident."