PrintNightmare: the bug Microsoft had already declared fixed, twice
Print Spooler RCE exposed every Windows machine; patches kept getting bypassed
The market's verdict: +3.3% on MSFT in the week after.
What actually happened
In July 2021, researchers accidentally published a working exploit for a remote code execution flaw in the Print Spooler service, which runs by default on every Windows machine including domain controllers. Microsoft's emergency patches landed July 6 and 7, after which new bypasses kept appearing, and the summer settled into a routine of toggling spooler off and setting registry keys while ransomware crews took notes. The flaw was old, the service was everywhere, and the fixes were iterative. Administrators describe that summer with a thousand yard stare and a print server.
This one is officially acknowledged.
Were you affected? Unbreak it
Install the out-of-band PrintNightmare fix ↗
Windows Update → Check for updates, or download KB 5004945 from catalog.update.microsoft.com.
Links
-
Acknowledgement
- MSRC (Microsoft) (official)
-
Context
- Microsoft Support (official)
↳ fixed_by KB5004945 (PrintNightmare out-of-band)
Timeline
- Jul 1, 2021 Confirmed First reports came in.
- Jul 6, 2021 Mitigated Out-of-band updates shipped July 6-7; bypasses kept coming.