Security readout for executives and security teams
Plain-English summary
CVE-2021-47739 is a local privilege escalation flaw in Epic Games Easy Anti-Cheat 4.0. A user who already has low-level access to a Windows system could abuse an incorrectly configured service path to run code as LocalSystem. This is serious for shared endpoints, gaming PCs, labs, and any enterprise machines where Easy Anti-Cheat is installed.
Executive priority
Treat as high priority on shared or enterprise-managed endpoints because it can turn ordinary local access into full system control. It is less urgent for systems without Easy Anti-Cheat 4.0 or without untrusted local users. Confirm exposure before broad remediation.
Technical view
The issue is CWE-428, an unquoted service path in Easy Anti-Cheat 4.0. The CVSS 4.0 score is 8.5, with local attack vector, low complexity, low privileges required, and no user interaction. Sources describe arbitrary code execution with elevated LocalSystem privileges during application startup. Public exploit documentation exists, but the bundle does not show active exploitation.
Likely exposure
Exposure appears limited to systems running Epic Games Easy Anti-Cheat 4.0. Risk is highest where untrusted or low-privileged users can access the same Windows host. No evidence in the provided sources expands affected versions beyond 4.0.
Exploitation context
This is not a remote internet-facing bug. An attacker needs local access with low privileges, then can potentially escalate to LocalSystem. ExploitDB is listed as a public exploit reference, but CISA KEV is false and no cited source confirms active exploitation.
Researcher notes
The provided sources identify Easy Anti-Cheat 4.0 and CWE-428 only. Public exploit material is referenced, but do not infer active exploitation. The bundle does not name a specific patched version, so remediation should be tied to current vendor guidance or removal of affected deployments.
Mitigation direction
- Identify systems with Epic Games Easy Anti-Cheat 4.0 installed.
- Check Epic Games or Easy Anti-Cheat guidance for fixed versions or vendor remediation.
- Upgrade, repair, or remove affected installations where vendor guidance supports it.
- Limit local user access on systems where Easy Anti-Cheat 4.0 remains installed.
- Prioritize shared workstations and systems used by untrusted or non-admin users.
Validation and detection
- Inventory installed Easy Anti-Cheat versions and confirm whether 4.0 is present.
- Review the Easy Anti-Cheat service configuration for unquoted executable paths.
- Confirm the service path cannot be abused by low-privileged users.
- Check whether vendor updates have changed the affected service configuration.
- Document compensating controls where immediate remediation is unavailable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-428: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-47739 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.5 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.5HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-49841CVE reference · exploit
- Epic Games Official WebsiteCVE reference · product
- Easy Anti-Cheat Official WebsiteCVE reference · product
- Zero Science Lab Disclosure (ZSL-2021-5652)CVE reference · third-party-advisory
- VulnCheck Advisory: Epic Games Easy Anti-Cheat 4.0 Local Privilege Escalation via Unquoted Service PathCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unquoted Search Path or Element
Unquoted Search Path or Element represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.