CISA Issues Alert on Active Exploitation of Microsoft Windows Privilege Escalation Flaw

According to CISA, active exploitation of a critical privilege escalation flaw in Microsoft Windows has been observed, with CVE-2021-43226 residing in the Common Log File System driver. The flaw allows attackers who gain local access to bypass security controls and elevate their privileges, potentially leading to full system compromise. The vulnerability was first disclosed by Microsoft in late 2021, and recent intelligence indicates threat actors have begun leveraging it in ransomware campaigns.

CISA added CVE-2021-43226 to its Known Exploited Vulnerabilities catalog on 6 October 2025, prompting urgent mitigations such as applying the latest Microsoft security updates and ensuring endpoint protection detects and blocks known exploitation attempts. The guidance also notes that organisations should consider temporary workarounds such as restricting access to the CLFS driver or isolating high‑risk systems, and to review logs for unusual CLFS activity and configure alerts for exploitation attempts.

To reduce exposure, CISA recommends discontinuing unsupported Windows installations and following Binding Operational Directive 22-01 for patched vulnerability disclosure and management where applicable.