EXPOSURES › CVE-2016-0099
CVE-2016-0099
CRITICAL ⌖ ON CISA KEV · EXPLOITEDA Microsoft Windows vulnerability allowed attackers to escalate privileges to administrator level, actively exploited and linked to ransomware campaigns.
CVE-2016-0099, a privilege escalation vulnerability in the Windows Secondary Logon Service, enabled attackers to execute arbitrary code as an administrator. This is a significant risk for DIB organizations as it directly impacts NIST 800-171 controls related to privilege management and system integrity; ensure all systems are patched and review access controls.
Shame score — The vulnerability's exploitation in ransomware campaigns and the potential for widespread impact despite its age demonstrates a concerning lack of proactive patching and system hardening.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |