A remote command execution vulnerability exists in Windows Print Spooler service improperly performs privileged file   operations. An authenticated, remote attacker can exploit this to bypass and run arbitrary code with SYSTEM privileges.     The remote system is not fully secure as the point and print registry settings contain an insecure configuration in   one of the following locations/keys:

    - HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
    - HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint\NoWarningNoElevationOnInstall
    - HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint\UpdatePromptSettings

Detections

Analytics

Windows PrintNightmare Registry Exposure CVE-2021-34527 OOB Security Update RCE (July 2021)

high Nessus Plugin ID 151488

Version 1.19

Version 1.18

Version 1.17

Version 1.16

Version 1.15

Version 1.14

Version 1.19 Oct 16, 2024, 4:49 PM Detection (fixed issue detecting registry keys) Plugin Feed: 202410161649
Version 1.18 May 7, 2024, 10:55 AM Detection Plugin Feed: 202405071055
Version 1.17 Dec 22, 2023, 3:04 PM Detection (added detection for Win10 22H2, Win11 21H2, and Win11 22H2) Plugin Feed: 202312221504
Version 1.16 Dec 15, 2023, 7:01 PM Detection (include check for Win10 21H2) Plugin Feed: 202312151901
Version 1.15 Feb 27, 2023, 2:07 PM Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202302271407
Version 1.14 Dec 6, 2022, 6:53 AM Reference Plugin Feed: 202212060653