EXPOSURES › CVE-2018-8589
CVE-2018-8589
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft Win32k privilege escalation flaw allowed local system-level remote code execution.
This vulnerability in Windows improperly handled Win32k.sys calls, enabling attackers to execute remote code with local system privileges. DIB organizations must ensure all Windows systems are patched against this actively exploited vulnerability to prevent lateral movement and data exfiltration. Failure to patch exposes the environment to ransomware and other advanced persistent threats.
Shame score — A known privilege escalation vulnerability in a core Windows component was actively exploited in the wild, demonstrating severe negligence in patch management and system hardening.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |