The vulnerability has been dubbed PrintNightmare and is tracked as CVE-2021-34527. The flaw is due to the Windows Print Spooler service improperly performing privileged file operations. Microsoft says the flaw can be exploited by an authenticated user calling RpcAddPrinterDriverEx(). When exploited, an attacker gains SYSTEM privileges and can execute arbitrary code, install programs, view, change, or delete data or create new accounts with full user rights.

A Local Privilege Escalation vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges.

An elevation of privilege vulnerability exists in the way the Windows Graphics Component handles objects in memory.

A vulnerability in the admin web interface could allow an authenticated attacker to upload a custom template to perform an arbitrary code execution. These templates can be used to display customised login and meeting pages and are rendered using the Perl Template Toolkit engine. This engine can be coerced into executing code by creating a new "BLOCK" by abusing the "template" global object to create a new block to be evaluated. The deployed agent will run with ROOT privileges.

This module first uses hard-coded credentials for the diagnostics user to authenticate in the UCMDB component. Then a java deserialization vulnerability present in several endpoints of the UCMDB service is used to execute commands. The deployed agent will run with the SYSTEM privileges on Windows and root on Linux.

An elevation of privilege vulnerability exists in the way the Windows Graphics Component handles objects in memory.

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

The Security Service of Cisco AnyConnect Posture (HostScan) for Windows incorrectly restricts access to internal IPC commands. This could enable low-privileged users to achieve NT AUTHORITY\SYSTEM privileges by sending crafted IPC commands. This module bypasses CVE-2021-1366 by abusing a Time-of-check Time-of-use (TOCTOU) Race Condition in the priv_file_copy command.

This module uses an unauthenticated remote PHP file upload vulnerability via File Manager (wp-file-manager) plugin in WordPress to upload and execute a PHP agent file to gain arbitrary code execution on the affected system.

This module uses an authenticated JNDI injection vulnerability via JndiBindingHandle class in Oracle Weblogic Server to upload and execute a java class file to gain arbitrary code execution on the affected system.