What To Know About Microsoft’s Registry Hive Flaw: #SeriousSAM

tl;dr — A Windows 10 local privilege escalation (CVE-2021-36934, “HiveNightmare”) in many supported builds allows non-administrative users to read registry hives and VSS snapshots to extract account credentials (LSASS/SAM), enabling full local admin takeover, credential theft, lateral movement, and persistence. No Microsoft patch was available in the report; recommendations include applying the documented workaround (restricting hive permissions and addressing VSS snapshots) and sweeping endpoints with incident response tools to detect and remediate exposures.