Security readout for executives and security teams
Plain-English summary
CVE-2021-28447 is a Windows security feature bypass affecting Early Launch Antimalware. It is not a remote break-in bug; the CVSS data requires local access with high privileges. The business concern is post-compromise defense weakening on unpatched Windows systems, especially servers or endpoints that rely on boot-time antimalware protections.
Executive priority
Patch through normal Windows security update processes, with priority for sensitive servers and high-risk endpoints. This is not evidenced as actively exploited, but it can weaken a security layer after an attacker already has powerful local access.
Technical view
The CVE is a Windows Early Launch Antimalware Driver security feature bypass with CVSS 3.1 score 4.4. The vector is local, low complexity, high privileges required, no user interaction, unchanged scope, and high integrity impact. Public research references Windows loader behavior around measured boot and malware signatures.
Likely exposure
Exposure is most likely on unpatched affected Windows 8.1, Windows 10 releases, Windows Server 2012/2012 R2, 2016, 2019, and Server Core variants listed by Microsoft. Practical risk depends on whether an attacker already has high local privileges.
Exploitation context
The provided sources do not show CISA KEV listing or confirmed active exploitation. CVSS lists exploit maturity as unproven. Treat this as a defense-bypass issue useful after privilege compromise, not as an initial access vulnerability based on the supplied evidence.
Researcher notes
Do not assess this as remotely exploitable from the supplied data. Key constraints are AV:L and PR:H. Research should focus on patch presence, affected OS build coverage, and whether operational controls limit high-privilege local access on exposed Windows assets.
Mitigation direction
- Apply Microsoft security updates for affected Windows versions as directed by MSRC.
- Prioritize systems where local administrators or service accounts are broadly exposed.
- Retire or isolate unsupported Windows versions that cannot receive security updates.
- Review endpoint hardening for privileged access and boot security controls.
- Check vendor guidance before applying compensating controls not named in Microsoft sources.
Validation and detection
- Inventory affected Windows client and server versions from asset management data.
- Confirm installed Microsoft security updates against MSRC guidance for CVE-2021-28447.
- Identify systems where local high-privilege access is common or weakly controlled.
- Review security monitoring for unexpected boot, driver, or antimalware integrity events.
- Document exceptions for systems that cannot be patched immediately.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-28447 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C0.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.4MediumVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28447CVE reference · x_refsource_MISC
- https://bi-zone.medium.com/measured-boot-and-malware-signatures-exploring-two-vulnerabilities-found-in-the-windows-loader-5a4fcc3c4b66CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.