PetitPotam (CVE-2021-36942)
Windows LSA Spoofing Vulnerability
Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply updates per vendor instructions.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2021-36942
Also Known as PetitPotam
PetitPotam is a publicly documented NTLM relay technique that can be used to attack Windows servers, including domain controllers. Microsoft's August 2021 updates addressed it as CVE-2021-36942, a Windows LSA spoofing vulnerability, and CISA noted reports of active exploitation.
Name sources
- Microsoft Releases August 2021 Security Updates (CISA)
- Windows Local Security Authority (LSA) Spoofing Vulnerability "PetitPotam" (Arctic Wolf)
- Microsoft Releases Guidance for Mitigating PetitPotam NTLM Relay Attacks (CISA)
- KB5005413: Mitigating NTLM Relay Attacks on Active Directory Certificate Services (Microsoft)
Description
Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:CExploitation Context
as of October 14, 2026- CISA added CVE-2021-36942 to the KEV catalog 83 days after its CVE record was published.
- It is one of 391 Microsoft entries in the CISA KEV catalog, and one of 83 added in 2021.
- Its current EPSS score (66.0%) is higher than that of 56% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Microsoft Windows Server 2008 R2 Service Pack 1 | 6.1.7601.0 to <6.1.7601.25685 |
| Microsoft | Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation) | 6.1.7601.0 to <6.1.7601.25685 |
| Microsoft | Microsoft Windows Server 2008 Service Pack 2 | 6.0.6003.0 to <6.0.6003.21192 |
| Microsoft | Microsoft Windows Server 2008 Service Pack 2 (Server Core installation) | 6.0.6003.0 to <6.0.6003.21192 |
| Microsoft | Microsoft Windows Server 2012 | 6.2.9200.0 to <6.2.9200.23435 |
| Microsoft | Microsoft Windows Server 2012 (Server Core installation) | 6.2.9200.0 to <6.2.9200.23435 |
| Microsoft | Microsoft Windows Server 2012 R2 | 6.3.9600.0 to <6.3.9600.20094 |
| Microsoft | Microsoft Windows Server 2012 R2 (Server Core installation) | 6.3.9600.0 to <6.3.9600.20094 |
| Microsoft | Microsoft Windows Server 2016 | 10.0.14393.0 to <10.0.14393.4583 |
| Microsoft | Microsoft Windows Server 2016 (Server Core installation) | 10.0.14393.0 to <10.0.14393.4583 |
| Microsoft | Microsoft Windows Server 2019 | 10.0.17763.0 to <10.0.17763.2114 |
| Microsoft | Microsoft Windows Server 2019 (Server Core installation) | 10.0.17763.0 to <10.0.17763.2114 |
| Microsoft | Microsoft Windows Server version 2004 | 10.0.0 to <10.0.19041.1165 |
| Microsoft | Microsoft Windows Server version 20H2 | 10.0.0 to <10.0.19042.1165 |
References
3 LinksRecord Details
More from Microsoft
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
Windows Print Spooler Remote Code Execution Vulnerability
Internet Shortcut Files Security Feature Bypass Vulnerability
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.