Endpoint and server security
CVE-2021-37852: LPE in ESET products for Windows
ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\SYSTEM.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| ESET NOD32 Antivirus 10.0.337.1 to 15.0.18.0 | Upgrade past 15.0.18.0; see the advisory |
| ESET Internet Security 10.0.337.1 to 15.0.18.0 | Upgrade past 15.0.18.0; see the advisory |
| ESET Smart Security 10.0.337.1 to 15.0.18.0 | Upgrade past 15.0.18.0; see the advisory |
| ESET Endpoint Antivirus for Windows 6.6.2046.0 to 9.0.2032.4 | Upgrade past 9.0.2032.4; see the advisory |
| ESET Endpoint Security for Windows 6.6.2046.0 to 9.0.2032.4 | Upgrade past 9.0.2032.4; see the advisory |
| ESET Server Security for Microsoft Windows Server 8.0.12003.0 to 8.0.12003.1 | Upgrade past 8.0.12003.1; see the advisory |
| ESET File Security for Microsoft Windows Server 7.0.12014.0 to 7.3.12006.0 | Upgrade past 7.3.12006.0; see the advisory |
| ESET Server Security for Microsoft Azure 7.0.12016.1002 to 7.2.12004.1000 | Upgrade past 7.2.12004.1000; see the advisory |
| ESET Security for Microsoft SharePoint Server 7.0.15008.0 to 8.0.15004.0 | Upgrade past 8.0.15004.0; see the advisory |
| ESET Mail Security for IBM Domino 7.0.14008.0 to 8.0.14004.0 | Upgrade past 8.0.14004.0; see the advisory |
| ESET Mail Security for Microsoft Exchange Server 7.0.10019 to 8.0.10016.0 | Upgrade past 8.0.10016.0; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\SYSTEM.
Workarounds
The attack surface can also be eliminated by disabling the Enable advanced scanning via AMSI option in ESET products’ Advanced setup.
However, ESET strongly recommends performing an upgrade to a fixed product version and only applying this workaround when the upgrade is not possible for an important reason.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.