July 2021 served Windows admins a lesson in one-line disaster: a support-tool change left copies of the Security Accounts Manager (SAM), SECURITY, and SYSTEM registry hives world-readable by non-privileged users — with Volume Shadow Copies preserving the older, password-hash-bearing versions. Any standard user on any affected box could harvest every local account’s NTLM hashes, including the machine’s built-in Administrator. Named HiveNightmare (also SeriousSAM, CVE-2021-36934), scored 7.8, trivially exploitable with public PoCs within days, it swept headlines as “the PrintNightmare sequel” — two months of Windows privilege-escalation chaos condensed into a summer nobody in endpoint defence forgot.
HiveNightmare (CVE-2021-36934, CVSS 7.8) made sensitive registry hive files — SAM (local account database), SYSTEM, and SECURITY — readable by the built-in Users group on Windows 10 (build 1809+, Server equivalents), via overly-permissive Access Control Lists left by a support-diagnostic operation. Combined with Volume Shadow Copy Service (VSS) snapshots (which pre-dated the fix and preserved the vulnerable ACLs), any local standard user could copy the SAM hive, extract NTLM password hashes for ALL local accounts (including RID-500 Administrator), and crack or pass-the-hash them. Public PoCs appeared within 72 hours (PowerShell one-liners circulating by mid-July). Microsoft’s July patch fixed ACLs but NOT the VSS snapshots — remediation required deleting old shadow copies explicitly (vssadmin delete shadows /for=C: /all /quiet class steps) or the hole stayed open through restore points. Elevation-of-privilege impacts: full local-account compromise, lateral movement via pass-the-hash, domain-joined machine credential exposure. The bug shipped in builds since ~October 2018 (version 1809) — dormant for ~2.5 years before discovery by an outside researcher using standard tooling, demonstrating how long simple permission mistakes persist unexamined in mature OS codebases.
What happened
The timeline compressed fast. Early July 2021 (posts from 4 July onward): discovery write-ups began circulating; within days, PoC scripts (PowerShell, C#) demonstrating shadow-copy SAM extraction were public. 20 July: Microsoft acknowledged, assigned CVE-2021-36934, and shipped a July cumulative-update patch — but the guidance revealed the VSS wrinkle: patched ACLs didn’t propagate to existing shadow copies, so admins had to also delete pre-patch snapshots manually or machines stayed exploitable.
The naming moment arrived because the bug sat adjacent to PrintNightmare in the calendar: defenders already battle-scarred from June’s spooler chaos got another “trivial LPE with PoC in the wild” within weeks. Microsoft’s own scoring (7.8, elevation of privilege) understated perceived pain: combined with any low-priv foothold (phished user, webshell, malware drop), HiveNightmare converted to instant local admin — the classic LPE commodity in intrusion chains.
The 2.5-year shipping window (1809 → disclosure) raised the uncomfortable audit question: how does a world-readable file ACL on the single most sensitive local database survive every security review, SDLC gate, and fuzzing cycle for nine-odd Windows builds? The answer — regression introduced by a support-tool path never re-checked against the permission baseline — became the standard argument for automated ACL/permission regression testing in OS and application CI, now common practice.
How it worked
The bug in one diagram:
Windows 10 1809+ / Server: support/diagnostic operation copies
C:\Windows\System32\config (SAM, SYSTEM, SECURITY)
with inheritance broken -> ACL grants "Users" READ
standard user attack:
1. enumerate VSS shadow copies (vssadmin list shadows
or Get-CimInstance Win32_ShadowCopy)
2. copy pre-patch SAM/SYSTEM/SECURITY from shadow:
?GLOBALROOTDeviceHarddiskVolumeShadowCopyX...
3. parse hive (Impacket/secretsdump or PoC tooling)
4. extract NTLM hashes for ALL local accounts
incl. RID 500 Administrator
5. crack (weak passwords) or pass-the-hash lateral
movement / local auth
why VSS mattered: the July patch fixed forward ACLs, but
existing shadow copies retained world-readable states -
explicit deletion required (vssadmin delete shadows)
or exploitability persisted through restore pointsThe composite lesson — simple permission regressions + snapshot/persistence semantics = serious LPE — generalises across platforms: Linux file-capability regressions, macOS installer-script permissions, and container image layer mistakes follow the same shape. Mature programmes now diff security-sensitive permissions in CI as a first-class check, the exact discipline our hardening-guidance coverage prescribes for golden images and exportable baselines.
Impact and numbers
| Metric | Value | Source |
|---|---|---|
| CVE | CVE-2021-36934 | Microsoft/NVD |
| CVSS v3 | 7.8 (privilege escalation) | Microsoft scoring |
| Affected builds | Win10 1809+ through 21H1; Server 2019+ | advisory scope |
| Bug lifetime | ~2.5 years (introduced ~Oct 2018) | build forensics |
| PoC availability | Public within ~72h of discovery | GitHub/press |
| Patch date | 2021-07 (out-of-band guidance + cumulative) | Microsoft |
| VSS remediation gap | Manual shadow-copy deletion required | KB5005343-class guidance |
Timeline
| Date | Event |
|---|---|
| 2018-10 | Regression ships with Windows 10 1809-era support-tool change |
| 2021-07-04/06 | Public discovery posts; “HiveNightmare/SeriousSAM” coined |
| 2021-07-12 | PoCs public; exploitation guidance circulating |
| 2021-07-20 | Microsoft confirms, assigns CVE-2021-36934, patches ACLs |
| 2021-07-27 | Follow-up guidance: delete old shadow copies (fix incomplete without) |
| 2021–2022 | Chained in commodity intrusion kits; folding into hardening baselines |
Why it still matters in 2026
HiveNightmare’s legacy is methodological: it proved that “boring” permission bugs in mature software can hide for years and then detonate as top-tier LPEs — so permission auditing must be continuous, automated, and regression-tested, not a penetration-test annual surprise. VSS/restore-point persistence taught the same for remediation completeness: a fix that ignores forensic copies, snapshots, backups, and container layers of the vulnerable state is a partial fix, a lesson repeated by later incidents (backup-domain persistent ACL bugs, IaC templates re-introducing old permissions). Operationally, the incident reinforced LPE-hygiene basics that remain 2026 table-stakes: restrict interactive logon rights, enforce LAPS-style unique rotating local-admin passwords (so a dumped SAM dies quickly), treat NTLM as legacy-to-kill (pass-the-hash fuels on), and monitor shadow-copy enumeration commands as detection tripwires. The defender takeaway distilled: audit your permissions like code, treat snapshots as live attack surface, and never let RID-500 be a shared secret — habits embedded in the endpoint baselines we maintain in infrastructure hardening guidance.
Detection and hardening takeaways
- Audit sensitive-file ACLs continuously. Script checks on %System32%config hives, private key stores, and service binaries; alert on any grant to Users/Everyone — the HiveNightmare shape (regressed inheritance) recurs in third-party software constantly.
- Rotate and randomise local admin passwords (LAPS). A dumped SAM is only valuable if hashes are shared/reused; automatic per-machine rotating credentials defang pass-the-hash and cracking at scale.
- Control and monitor VSS. Restrict shadow-copy enumeration to admins in policy where feasible; alert on vssadmin/Get-CimInstance shadow-copy listing by non-admin contexts — pre-exfil reconnaissance beacon.
- Delete shadow copies after vuln remediation. Post-patch, remove pre-fix snapshots (and rotate credentials potentially exposed) as a step in the remediation runbook — the incomplete-fix trap HiveNightmare set for thousands of orgs.
- Monitor credential-dumping signatures. Detect hive-copy-then-parse patterns: SAM file access by unusual processes, secretsdump-class tooling executions, lsass/SAM reads from user-context handles — cheap EDR telemetry with high signal.
FAQ
Was HiveNightmare as bad as PrintNightmare?
Different class: PrintNightmare was remote-code execution (SYSTEM from remote contexts in misconfig cases); HiveNightmare required local standard-user access. But in real intrusion chains, attackers always have a low-priv foothold first (phishing, webshell), so a trivially-reliable local LPE was nearly as valuable — chained, both produced instant admin. Together they made summer 2021 the season Windows defenders stopped trusting default configurations.
Why didn’t the patch fully fix it?
The July update corrected the file ACLs going forward, but Volume Shadow Copies already contained world-readable copies of the hives with old permissions — and patching doesn’t rewrite snapshots. Microsoft’s explicit extra step: delete old shadow copies. The gap is the canonical example of remediation completeness requiring you to think about every persistent copy of vulnerable state.
Could this happen again today?
The specific bug is dead, but the class is perennial: permission regressions in support utilities, installer scripts, and container builds surface regularly across all operating systems. The difference now is detection maturity — automated ACL regression checks, EDR credential-access telemetry, and hardening baselines make both exploitation and persistence harder. That’s why HiveNightmare remains taught: not for the SAM file specifically, but for the audit discipline it forces.
Two lines of code, every hash on the machine
HiveNightmare (aka SeriousSAM) — the Windows permission bug exposing SAM database files to non-administrative accounts via Volume Shadow Copies — compressed the privilege-escalation genre to its essentials: a two-line effective access-control misconfiguration, present since Windows 10 1809, exposing local password hashes to any logged-on user. No exploit, no memory corruption, no chain — just a default that let unprivileged processes read the credential store, with the shadow-copy mechanism preserving the readable copies even after Microsoft tightened the live-file permissions.
The immediate wave — in-the-wild tools wrapping the bug into hash-dumping one-liners within days — demonstrated the commodity-escalation lifecycle: an access-control bug prices identically to an exploit once tooling exists, and local hash access feeds directly into offline cracking and lateral movement via pass-the-hash. The defensive doctrine is the standing one: treat local credential stores as crown jewels (Credential Guard-style protections, LAPS for rotating local admin credentials so hash theft buys little, and privilege-tiering so workstation compromise does not cascade), because the class of bugs that reads them recurs annually under new names.
The patch-verification lesson repeated too: initial mitigations required specific actions (deleting shadow copies, registry hardening) beyond patch installation, and enterprises that closed the CVE without running the verification steps retained readable copies — the PrintNightmare doctrine in miniatures. Small bug, fast weaponization, configuration-dependent remediation: the whole vulnerability-management curriculum in a summer-week incident.
The local-credential doctrine that HiveNightmare reinforced deserves its closing placement in the tiering canon: the workstation tier is assumed-compromised territory in mature architectures, and every control on it — Credential Guard, LAPS rotation, privilege separation — exists to make that assumption cheap. Bugs of this class will keep arriving because operating systems will keep shipping access-control defaults that age badly; the architecture that assumes their arrival spends the summer patching, while the architecture that assumes their absence spends it recovering. Two lines of code made the point; the doctrine keeps making it annually, under whatever name the next default carries.
Related Reading
- What Studying 33 Historic Cyberattacks Taught Me About Defending Systems Today
- Passwordless in 2026: Why Passkeys Are Finally Killing the Password (and How Attackers Are Adapting)
- 2022–2024: Lapsus$, Change Healthcare & the XZ Backdoor
- Authoritative reference: CISA Known Exploited Vulnerabilities
- PwnKit: The 12-Year Local Root in Every Linux
- Internet Explorer CVE-2020-0674: The Zero-Day Advisory That Opened 202
- Exchange CVE-2020-0688: A Default Key Made Every Server Alike
