Windows DCOM Server Security Feature Bypass

The remote Windows DCOM Server may be in a vulnerable state to exploitation by having the HKLM\Software\Microsoft\Ole\AppCompat\RequireIntegrityActivationAuthenticationLevel registry value set to 0. Hardening changes in DCOM were required for CVE-2021-26414 and were implemented in 2 phases on June 8, 2021 and June 14, 2022 as described in KB5004442. Without the March 2023 Microsoft upgrade (phase 3), DCOM hardening can be manually disabled by setting this registry value to 0 on the server side to help mitigate compatibility issues. This presents a vulnerability risk and should be avoided. With the March 2023 update, DCOM hardening is enabled by default, and is no longer affected by the registry setting.

The remote Windows host is missing security update 5003646. It is, therefore, affected by multiple vulnerabilities

The remote Windows host is missing security update 5003637. It is, therefore, affected by multiple vulnerabilities

The remote Windows host is missing security update 5003635. It is, therefore, affected by multiple vulnerabilities

The remote Windows host is missing security update 5003694. It is, therefore, affected by multiple vulnerabilities

The remote Windows host is missing security update 5003638. It is, therefore, affected by multiple vulnerabilities

The remote Windows host is missing security update 5003697. It is, therefore, affected by multiple vulnerabilities

The remote Windows host is missing security update 5003695. It is, therefore, affected by multiple vulnerabilities

The remote Windows host is missing security update 5003681. It is, therefore, affected by multiple vulnerabilities

The remote Windows host is missing security update 5003687. It is, therefore, affected by multiple vulnerabilities

ID	Name	Product	Family	Severity
170626	KB5004442: Windows DCOM Server Security Feature Bypass Registry Check (CVE-2021-26414)	Nessus	Windows	medium
150374	KB5003646: Windows 10 version 1809 / Windows Server 2019 Security Update (June 2021)	Nessus	Windows : Microsoft Bulletins	critical
150370	KB5003637: Windows 10 version 2004 / Windows 10 version 20H2 / Windows 10 version 21H1 Security Update (June 2021)	Nessus	Windows : Microsoft Bulletins	critical
150369	KB5003635: Windows 10 version 1909 Security Update (June 2021)	Nessus	Windows : Microsoft Bulletins	critical
150368	KB5003694: Windows 7 and Windows Server 2008 R2 Security Update (June 2021)	Nessus	Windows : Microsoft Bulletins	critical
150367	KB5003638: Windows 10 version 1607 / Windows Server 2016 Security Update (June 2021)	Nessus	Windows : Microsoft Bulletins	critical
150363	KB5003697: Windows Server 2012 Security Update (June 2021)	Nessus	Windows : Microsoft Bulletins	critical
150357	KB5003695: Windows Server 2008 Security Update (June 2021)	Nessus	Windows : Microsoft Bulletins	critical
150354	KB5003681: Windows 8.1 and Windows Server 2012 R2 Security Update (June 2021)	Nessus	Windows : Microsoft Bulletins	critical
150353	KB5003687: Windows 10 version 1507 LTS Security Update (June 2021)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2021-26414

medium

Tenable Plugins

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical