Loading CVE intelligence

CVE-2021-1675

HighPublished

Windows Print Spooler Remote Code Execution Vulnerability

Published: Jun 8, 2021
Updated: Aug 12, 2026
Assigning CNA: microsoft
Evidence observed: Nov 3, 2021

Primary CVSS

7.8/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS probability estimate

86.1%

High · next 30 days

Percentile: 99.7%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

Windows Print Spooler Remote Code Execution Vulnerability

Sources

53

CVE-2021-1675Exploit
Local privilege escalation exploit for CVE-2021-1675 (PrintNightmare) that installs a malicious DLL to gain SYSTEM access on vulnerable Windows systems.
SpoolSploitExploit
A collection of Windows print spooler exploits containerized with other utilities for practical exploitation.
CVE-2021-1675PoC
Pure PowerShell implementation of CVE-2021-1675 Print Spooler Local Privilege Escalation (PrintNightmare)
CVE-2021-1675

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.

Exploit

C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527

CVE-2021-1675Detection

Zeek script and Suricata rules to detect PrintNightmare (CVE-2021-1675) exploitation via RpcAddPrinterDriver DCE RPC events, with PCAP-based testing.

CVE-2021-1675Exploit

C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527

CVE-2021-1675_PrintNightMareScanner

Scanner to detect Windows Print Spooler RCE vulnerability (CVE-2021-1675) across single IPs, IP lists, or CIDR ranges using Python.

CVE-2021-1675Exploit

Proof-of-concept exploit for CVE-2021-1675 (PrintNightmare) targeting Windows Print Spooler. Uses msfvenom-generated malicious DLL delivered via SMB to achieve remote code execution and Meterpreter reverse shell.

CVE-2021-1675Exploit

Impacket-based exploit for PrintNightmare (CVE-2021-1675/34527) enabling remote or local DLL execution against Windows print spooler services.

CVE-2021-1675-LPE-EXPExploit

PrintNightmare , Local Privilege Escalation of CVE-2021-1675 or CVE-2021-34527

PrintNightmare-CVE-2021-1675-CVE-2021-34527Exploit

CVE-2021-1675 / CVE-2021-34527 - PrintNightmare Python, C# and PowerShell Exploits Implementations (LPE & RCE)

my-CVE-2021-1675Exploit

Detailed analysis and exploit implementation for Windows PrintNightmare (CVE-2021-1675/34527) with RPC-based privilege escalation and remote code execution via malicious printer driver installation.

cve-2021-1675-printnightmareDetection

Zeek package to detect CVE-2021-1675 (PrintNightmare) by monitoring named pipes and RPC operations for spoolss exploitation attempts.

PrintNightmareResearch

Information on the Windows Spooler vulnerability - CVE-2021-1675; CVE 2021 34527

cve-2021-1675Exploit

Exploit for CVE-2021-1675 (PrintNightmare) enabling local and remote SYSTEM-level privilege escalation on Windows via the Print Spooler service. Includes Ladon module integration.

CVE-2021-1675-PrintNightmareExploit

PowerShell exploit for CVE-2021-1675 (PrintNightmare) performing local privilege escalation via Print Spooler, with custom DLL payload injection and user creation in local admin group.

PrintNightmareExploit

Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527)

CVE-2021-1675_CarbonBlack_HuntingQueryDetection

CarbonBlack hunting queries to detect PrintNightmare (CVE-2021-1675) exploitation via file, module load, and process events, based on Sigma rules.

PrintNightmare-CVE-2021-34527Exploit

PrintNightmare - Windows Print Spooler RCE/LPE Vulnerability (CVE-2021-34527, CVE-2021-1675) proof of concept exploits

CVE-2021-1675Patch

CVE-2021-1675: ZERO-DAY VULNERABILITY IN WINDOWS PRINTER SERVICE WITH AN EXPLOIT AVAILABLE IN ALL OPERATING SYSTEM VERSIONS

CVE-2021-1675Exploit

Impacket-based exploit for CVE-2021-1675 (PrintNightmare) enabling remote or local DLL execution on Windows Domain Controllers with SMB payload hosting and vulnerability scanning.

CVE-2021-1675Patch

Fix without disabling Print Spooler

calebstewart-CVE-2021-1675Exploit

PowerShell script for local privilege escalation on Windows via the PrintNightmare vulnerability (CVE-2021-1675), adding a local admin user or executing custom DLL payloads.

cube0x0-CVE-2021-1675Exploit

Impacket-based exploit for CVE-2021-1675/34527 (PrintNightmare) enabling remote or local DLL execution on vulnerable Windows systems, with scanning and mitigation guidance.

CVE-2021-1675Exploit

PowerShell exploit for CVE-2021-1675 (PrintNightmare) performing local privilege escalation via Print Spooler, with custom DLL payload injection to add local admin users.

CVE-2021-1675-PrintNightmare-AnalysisResearch

Technical write-up and analysis of PrintNightmare (CVE-2021-1675 / CVE-2021-34527), covering RCE/LPE exploitation, detection via Windows event logs, and mitigation for Print Spooler.

CVE-2021-1675-CVE-2021-34527Exploit

PowerShell exploit for PrintNightmare (CVE-2021-1675) performing local privilege escalation via Print Spooler, with custom DLL payload injection to add local admin users.

CVE-2021-1675---PrintNightmare-LPE-PowerShell-Exploit

PowerShell exploit for CVE-2021-1675 (PrintNightmare) performing local privilege escalation by adding a user to the local administrators group via Print Spooler.

Microsoft-CVE-2021-1675Exploit

C# exploit for CVE-2021-1675, a Windows Print Spooler elevation of privilege vulnerability. Executes arbitrary DLLs via driver path to achieve local privilege escalation.

CVE-2021-1675PoC

Educational proof-of-concept for PrintNightmare (CVE-2021-1675/34527) with simulated non-functional payload, attack flow analysis, MITRE mapping, detection guidance, and remediation steps.

CVE-2021-1675Detection

CVE-2021-1675 Detection Info

SharpPNExploit

C# PrintNightmare (CVE-2021-1675)

cve-2021-1675Exploit

PowerShell exploit for CVE-2021-1675 PrintNightmare that disables AMSI and creates a local administrator account on vulnerable Windows systems.

Windows_ExploitExploit

CVE-2021-1675/CVE-2021-34527 PrintNightmare & CVE-2020-0668

CVE-2022-26809Exploit

Impacket-based exploit for PrintNightmare (CVE-2021-1675/CVE-2021-34527) enabling remote DLL execution via SMB, with scanning and mitigation guidance.

CVE-2021-1675-YaraDetection

YARA rules for detecting CVE-2021-1675 (PrintNightmare) exploitation attempts and related malware artifacts.

NimNightmarePoC

CVE-2021-1675 LPE PoC in Nim (PrintNightmare Local Privilege Escalation)

PrintNightmare-CVE-2021-1675Exploit

Youtube : https://youtu.be/Zr0KjYDSFKQ

patch-cve-2021-1675Exploit

PowerShell script to patch or exploit CVE-2021-1675 (PrintNightmare) vulnerability in Windows Print Spooler service for privilege escalation testing.

CVE-2021-1675_RDL_LPEExploit

PrintNightMare LPE提权漏洞的CS 反射加载插件。开箱即用、通过内存加载、混淆加载的驱动名称来ByPass Defender/EDR。

CVE-2021-1675-PrintNightmarePoC

Working PowerShell POC

PrintNightmareExploit

Windows Print Spooler Service RCE CVE-2021-1675 (PrintNightmare)

PNCVE-Win10-20H2-ExploitExploit

A one-click script to gain a System privileges command line in Windows 10 20H2 that exploits CVE-2021-1675

PrintNightmare-LPEPoC

CVE-2021-1675 (PrintNightmare)

NPE-CS-V-CVE-2021-1675PoC

Exploit code for CVE-2021-1675, a Windows Print Spooler remote code execution vulnerability, demonstrating the attack and providing a proof-of-concept for security testing.

CVE-2021-1675Exploit

Remote privilege escalation exploit for CVE-2021-1675 (PrintNightmare) with DLL injection and port forwarding support for remote execution.

CVE-2021-1675Exploit

CVE-2021-1675 exploit

ItWasAllADreamScanner

A PrintNightmare (CVE-2021-34527) Python Scanner. Scan entire subnets for hosts vulnerable to the PrintNightmare RCE

CVE-2021-34527Exploit

PowerShell local privilege escalation exploit for PrintNightmare (CVE-2021-34527) targeting Windows Print Spooler. Embeds custom DLL payload to add local admin user via reflective Win32 API calls.

CVE-2021-34527Detection

Small Powershell Script to detect Running Printer Spoolers on Domain Controller

CVE-2021-34527-1675Exploit

Cve-2021-1675 or cve-2021-34527? Detailed analysis and exploitation of windows print spooler 0day vulnerability！！！

CVE-2021-34527Exploit

PowerShell script for local privilege escalation via PrintNightmare (CVE-2021-34527). Injects a custom DLL payload to add a local admin user, leveraging Print Spooler APIs without remote RPC/SMB.

CVE-2021-34527Exploit

PrintNightmare (CVE-2021-34527) PoC Exploit