CISA Issues Emergency Directive on Microsoft Windows Print Spooler

CISA has issued Emergency Directive (ED) 21-04: Mitigate Windows Print Spooler Service Vulnerability addressing CVE-2021-34527. Attackers can exploit this vulnerability to remotely execute code with system level privileges enabling a threat actor to quickly compromise the entire identity infrastructure of a targeted organization.  

Specifically, ED 21-04 directs federal departments and agencies to immediately apply the Microsoft July 2021 updates and disable the print spooler service on servers on Microsoft Active Directory (AD) Domain Controllers (DCs).

Although ED 21-04 applies to Executive Branch departments and agencies, CISA strongly recommends that state and local governments, private sector organizations, and others review ED 21-04: Mitigate Windows Print Spooler Service Vulnerability for additional mitigation recommendations.