CVE-2021-41373

FAUCET Score

CVE-2021-41373 is an information disclosure vulnerability affecting Microsoft FSLogix. This medium-severity flaw (CVSS 5.5) allows a local, low-privileged attacker to achieve high confidentiality impact without user interaction. While not actively exploited (no KEV entry) and lacking public exploit code, it has received some community and media attention, including coverage in Microsoft's November 2021 Patch Tuesday.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 2.9.7979.62170CPE matchmatch criteria	cpe:2.3:a:microsoft:fslogix::::::::
		>= 2.0.0.0, < 2.9.7979.62170CPE match	cpe:2.3:a:microsoft:fslogix::::::::

CVSS Data

CVSS version used by this source: 3.1

5.5MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Exploitability Score

1.8

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

0.71%

Probability of exploitation in next 30 days

EPSS Percentile

49.9%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0072 is in the 95th percentile among its peer group of 15,938 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

microsoftpatch availablevia nvd_reference

View patch

microsoftpatch availablevia msrc

Product: FSLogixFixed in: 2.9.7979.62170

View patch

Vendor Advisories (1)

microsoft2021-Nov/CVE-2021-41373Important

FSLogix Information Disclosure Vulnerability

Nov 9, 2021

References

portal.msrc.microsoft.com / en-US/security-guidance/advisory/CVE-2021-41373

PatchVendor Advisory