How to Mitigate Microsoft Print Spooler Vulnerability – PrintNightmare

This week, PrintNightmare – Microsoft’s Print Spooler vulnerability (CVE-2021-34527) was upgraded from a ‘Low’ criticality to a ‘Critical’ criticality.

This is due to a Proof of Concept published on GitHub, which attackers could potentially leverage for gaining access to Domain Controllers.

As we reported earlier, Microsoft already released a patch in June 2021, but it wasn’t enough to stop exploits. Attackers can still use Print Spooler when connecting remotely. You can find all you need to know about this vulnerability in this article and how you can mitigate it (and you can).

Print Spooler in a nutshell: Print Spooler is Microsoft’s service for managing and monitoring files printing. This service is among Microsoft’s oldest and has had minimal maintenance updates since it was released.

Every Microsoft machine (servers and endpoints) has this feature enabled by default.

PrintNightmare vulnerability: As soon as an attacker gains limited user access to a network, he will be able to connect (directly or remotely) to the Print Spooler. Since the Print Spooler has direct access to the kernel, the attacker can use it to gain access to the operating system, run remote code with…