Microsoft recently released a privilege escalation vulnerability dubbed “HiveNightmare”. HiveNightmare affects Windows platform and grants read privileges to non-administrative users accessing system32/config files. Exploitation of the vulnerability allows an attacker with limited local user privileges to gain access to hashed passwords, as well as elevate their privileges to admin.

At this moment, Microsoft has not released a patch to fix this vulnerability. Microsoft recommend to implement the workaround of restricting access to the contents of %windir%\system32\config and delete any System Restore points and Shadow volumes that existed prior to restricting access to %windir%\system32\config.

For more information please see: 
Windows Elevation of Privilege Vulnerability

System / Technologies affected: