Microsoft · Enhanced Cryptographic Provider

CVE-2021-31201

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

Exploited in attacks Medium 5.2 Attack chance: 2.6%

What it is

Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

CISA: Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: November 17, 2021

Added to the CISA list: November 3, 2021
Published: June 8, 2021
Severity: Medium 5.2 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 2.6% in the top 14.6% of all known vulnerabilities
More details: NVD · CVE.org · CISA

All references (1)

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31201

More exploited flaws from Microsoft

Added	Vulnerability	Product	Severity	Attack chance
Nov 3, 2021	Privilege EscalationCVE-2021-31199	Enhanced Cryptographic Provider	Medium 5.2	3.0%
Oct 13, 2026	Command InjectionCVE-2026-96951	Windows	High 8.8	9.8%
Sep 25, 2026	Code InjectionCVE-2026-65660	SharePoint	High 8.8	8.2%
Sep 8, 2026	Link FollowingCVE-2026-81963	Windows	High 7.8	0.4%
Sep 8, 2026	Heap-Based Buffer OverflowCVE-2026-85880	Windows	High 7.8	0.4%
Aug 26, 2026	Remote Code ExecutionCVE-2019-1068	SQL Server	High 8.8	57%
Aug 18, 2026	Double FreeCVE-2026-33824	Internet Key Exchange (IKE) Service Extensions	Critical 9.8	77%
Aug 18, 2026	Weak AuthenticationCVE-2026-55040	SharePoint	Critical 9.1	70%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.