PrintNightmare Explained for IT Teams: CVE-2021-34527, Its CVSS Score and the 2026 Hardening Checklist

Updated: November 2026. CVE scores, patch dates, registry values, driver dates and NVD counts checked against MSRC, NVD, CISA and Microsoft Learn on 11 November 2026.

When a shared printer suddenly asks for admin rights, that's the 2021 print spooler fix at work, and the registry tweaks that silence it reopen the hole. Years later, the spooler is back on the monthly patch list, and Windows is moving off the third-party driver model the original exploit abused. This guide explains PrintNightmare for IT teams in 2026: the CVEs and scores, how the patches work, and how to check a fleet by server role.

TL;DR

• What it is. PrintNightmare (CVE-2021-34527) let an authenticated user run code as SYSTEM through the Windows Print Spooler service.
• Severity. It scores 8.8 High on CVSS 3.1, and Microsoft separately rates it Critical.
• The fix. The July 2021 updates patch it, but loosening the Point and Print driver settings leaves patched hosts exploitable.
• 2026. NVD lists 46 Print Spooler CVEs published this year, 20 of them on 10 November.
• Baseline. Disable the spooler on domain controllers, keep driver installs admin-only and patch every month.

What Is PrintNightmare?

PrintNightmare is the public name for CVE-2021-34527, a remote code execution flaw in the Windows Print Spooler service. MSRC says the spooler mishandles privileged file operations, and an attacker who exploits it runs code with SYSTEM privileges.

In plain terms, a user with an ordinary account could get a Windows host to install a driver of their choosing. That driver then ran with full control. Microsoft Learn explains why the spooler makes a good target: it runs as SYSTEM, standard users can reach it, and it loads third-party driver code on demand. Our guide to remote code execution covers this class of bug.

MSRC listed every Windows version as vulnerable.

PrintNightmare CVSS Scores and Severity Ratings

Two related CVEs from summer 2021 sit next to PrintNightmare's. Microsoft and NIST agree on two of the three scores, and the labels depend on whose scale you read.

NVD labels 8.8 High because that's its CVSS band. Critical is Microsoft's own severity scale, which is why both words appear next to the same CVE. See how CVSS scores work for the NVD side.

CVE-2021-34527 launched without a score: MSRC published it on 1 July 2021 and added the CVSS a day later. CVE-2021-34481 has two numbers because NIST scored it as needing no privileges and Microsoft didn't.

How Microsoft Patched PrintNightmare in 2021

The fix came in stages, and the first one missed. On 8 June 2021, Patch Tuesday fixed CVE-2021-1675 as an elevation of privilege bug, and Microsoft reclassified it as RCE on 21 June. On 30 June, CISA warned of public exploit code the June update didn't stop. It told admins to disable the spooler on domain controllers and systems that don't print.

Lawrence Systems posted this PrintNightmare explainer on 1 July 2021, under the old CVE-2021-1675 number. It's the week-one view, published before the July patches shipped.

Microsoft assigned CVE-2021-34527 on 1 July. Out-of-band updates shipped on 6 July, with Windows 10 1607, Server 2016 and Server 2012 following on 7 July. The 13 July cumulative updates carry the same fix, and MSRC says updates from 6 July cover both CVEs.

After the July updates, only administrators could install drivers on a print server (KB5005010). The 10 August 2021 updates made admin-only Point and Print driver installs the default. That's why shared printers started asking for admin credentials.

The timeline runs from the June 2021 patch to the 2027 printer driver cutoff.

Point and Print Settings That Undo the Patch

Point and Print lets a user connect to a shared printer and pull its driver from the print server. MSRC says it isn't directly related to PrintNightmare, but certain configurations make patched systems exploitable. These values live under HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint.

A driver value of 1, or undefined, overrides both prompt values. At 0, one non-zero prompt value leaves a fully patched host exploitable.

KB5005652 is blunt about the first row: "There is no combination of mitigations that is equivalent to setting" it to 1. It allows 0 only as a temporary step. The matching Group Policy, Limits print driver installation to Administrators, sits under Computer Configuration > Administrative Templates > Printers. Our Group Policy Editor guide covers it alongside other printer GPOs.

In August 2026, an r/sysadmin admin set approved print servers through Intune, with the driver restriction turned off, and non-admins still got a UAC prompt. Replies explain that the prompts are a separate control from the driver restriction. They also say to read the PointAndPrint key on a failing PC instead of trusting the Intune report.

Adding Printers Without Admin Rights

Setting the driver value to 0 lets non-admins install drivers, and Microsoft says that makes devices vulnerable. These three routes avoid it:

• Pre-stage drivers in the build image, or push them with Intune or an RMM, so users only add the queue.
• Grant one-off elevation for the install through endpoint privilege management.
• Turn on Windows protected print mode where printers support it, so Point and Print never installs a third-party driver.

If a migration forces 0, give it an end date and track the hosts. For that window, Microsoft lists partial mitigations, including the Package Point and print - Approved servers policy, which limits clients to listed servers. Pair it with Point and Print Restrictions, because clients fall back to non-package connections when a package connection fails.

This r/sysadmin thread from November 2022 starts with GPO-deployed printers that stopped mapping on new PCs without admin credentials. Replies split three ways: pre-stage drivers, use type 4 drivers, or set 0 with an approved-server list, which other replies warn reopens the hole.

Why the Print Spooler Still Matters in 2026

PrintNightmare dates from 2021, but the spooler keeps collecting CVEs. Here are NVD counts of CVEs whose description names the Print Spooler, by publish date, pulled on 11 November 2026.

The 2026 count landed in bursts: 12 in September, 8 in October and 20 in the November 2026 release.

Of the 46, 12 are network CVEs, 1 is adjacent-network and 33 are local. Four network CVEs carry Microsoft's 8.8, PrintNightmare's score. CVE-2026-58608 (14 July) also shares its vector: an authenticated attacker, no user action. Microsoft rates it Critical, though NVD scores it 7.5. The other three, CVE-2026-85877 (8 September) and CVE-2026-112762 and CVE-2026-119950 (both 10 November), trigger when a user connects to a malicious server or a crafted shared printer. That's one more reason to keep the approved-servers list short.

Microsoft marks none of the four as exploited, and none is in CISA's Known Exploited Vulnerabilities (KEV) catalog. Older spooler bugs are there: KEV lists 6, and 4 carry Known in its ransomware-use field, CVE-2021-1675, CVE-2021-34527, CVE-2022-21999 and CVE-2022-41073. That ties the spooler to ransomware attacks on CISA's record.

Microsoft reported in April 2024 that Forest Blizzard had used a tool, GooseEgg, to exploit spooler bug CVE-2022-38028 since at least June 2020, possibly April 2019. The bug was patched on 11 October 2022. Microsoft's advice repeated 2021's: disable the spooler on domain controllers. CISA added the CVE to KEV on 23 April 2024, and our explainer on exploited in the wild covers what that listing means.

CISA closed Emergency Directive 21-04 on 8 January 2026 and moved its actions to BOD 22-01, the KEV directive. BOD 26-04 replaced BOD 22-01 on 10 June 2026, and CVE-2021-34527 is still listed in the KEV catalog.

Windows Protected Print Mode and Third-Party Drivers

Microsoft's longer-term answer is to stop loading drivers it didn't write. Windows protected print mode (WPP), announced on 13 December 2023, blocks third-party printer drivers and child processes from the spooler, and strips two high privileges from its worker. Microsoft's 2023 announcement put print bugs at 9% of all Windows cases reported to MSRC. By Microsoft's count, WPP mitigates more than half of past Windows print security bugs.

WPP needs Windows 11 24H2 (build 26100) or later, in Pro, Enterprise, Education or IoT Enterprise. It's built for Mopria-certified printers, which Microsoft says number over 120 million sold. Turning it on uninstalls printers that use third-party drivers and removes XPS and fax. It's off by default, and Microsoft says it'll become the default at a later date it hasn't named.

Enable it with Group Policy at Computer Configuration > Administrative Templates > Printers > Configure Windows protected print. In Intune, use the OMA-URI ./Device/Vendor/MSFT/Policy/Config/Printers/ConfigureWindowsProtectedPrint as a String set to <enabled/>. Start with a pilot group in your Windows patch rings, because a client with WPP on can't use Print Management on servers that have it off.

Driver changes run on their own clock, for Windows 11+ and Windows Server 2025+.

Vendors can still ship drivers in their own packages, and Microsoft has no plan to switch off v3 and v4 driver features.

How to Check a Fleet for PrintNightmare Exposure

Run these eight checks and judge each result against the host's role.

Disabling inbound connections keeps local printing working. Any cumulative update since 13 July 2021 carries the PrintNightmare fix, but the 2026 CVEs need current ones, and your patch compliance reports already hold that row.

This PowerShell reads the service and registry rows on one host. It's a starting point built from Microsoft's documented names, so test it on a lab VM first. A blank value means not defined.

powershell
Get-Service -Name Spooler | Select-Object Status, StartType
Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -ErrorAction SilentlyContinue |
  Select-Object RestrictDriverInstallationToAdministrators, NoWarningNoElevationOnInstall, UpdatePromptSettings
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Print' | Select-Object RpcAuthnLevelPrivacyEnabled

Wrap it in Invoke-Command or an RMM script for more hosts, and see our PowerShell service commands guide.

If a host fails the spooler row, MSRC's workaround is Stop-Service -Name Spooler -Force, then Set-Service -Name Spooler -StartupType Disabled. That stops all printing on the host, so check its role first.

Print Spooler Hardening by Server Role

This baseline keeps the 2021 fix intact and switches the spooler off wherever nothing prints.

The DC row comes from Microsoft's Defender for Identity assessment. The trade-off: the DC role runs a spooler thread that prunes stale print queue objects from AD, so with the spooler off, prune them on a schedule. Our guide to domain controller hardening covers the rest.

Every spooler you switch off shrinks the attack surface the 2026 CVEs can reach.

Print servers go first in each month's patch run. If yours still runs Server 2016, see our Server 2016 retirement guide.

Detecting Print Spooler Exploitation

Detection tells you whether someone got in before the patch. MSRC's PrintNightmare FAQ points to Microsoft 365 Defender hunting queries that other tools can adapt. That repository is archived, and the queries now sit in Microsoft's Azure-Sentinel repository on GitHub. Watch for these signals, drawn from those queries, Microsoft's event documentation and the GooseEgg report:

• spoolsv.exe starting rundll32.exe with an empty command line, or another SYSTEM child process within 5 minutes of a driver-folder image load.
• New files in System32\spool\drivers, especially DLLs written to \x64\3\ and then loaded from \x64\3\Old.
• Event 808 in Microsoft-Windows-PrintService/Admin, logged when the spooler fails to load a plug-in module.
• A modified MPDW-Constraints.js under DriverStore\FileRepository\pnms009.inf_amd64_*, or a scheduled task \Microsoft\Windows\WinSrv, both GooseEgg indicators.

The queries read Defender process, file and image-load events, but the logic maps to Sysmon or EDR data. Our guide to SIEM rules covers turning signals into alerts.

Our guide to log collection covers forwarding event logs from print servers and DCs.

Treat the GooseEgg files as indicators of compromise: a hit means investigating the host as well as patching it.

OpenFrame is open, AI-native infrastructure for IT and security. It runs osquery policies with a pass or fail result and scheduled scripts across devices, and its SIEM keeps logs and raises alerts. It isn't EDR and has no built-in PrintNightmare detection, so you write and test the checks yourself. Fae resolves support requests and Mingo runs IT operations. OpenFrame costs $1 per device per month, with a 14-day free trial. Flamingo builds OpenFrame, which covers patching and SIEM.

The Short Version

PrintNightmare is a 2021 spooler bug, scored 8.8 High and rated Critical by Microsoft, and the July 2021 updates fix it. The fix holds only while driver installs stay admin-only, which is the default since August 2021. The spooler keeps shipping new CVEs in 2026, so turn it off on DCs and idle servers, pilot protected print mode and patch monthly. Next, our Patch Tuesday guide explains where out-of-band releases fit in the monthly cycle.