EXPOSURES › CVE-2002-0367
CVE-2002-0367
HIGH ⌖ ON CISA KEV · EXPLOITEDA 2002 Windows privilege escalation flaw in smss.exe allowed local users to gain SYSTEM privileges without proper authentication.
This unpatched vulnerability was actively exploited in the wild, enabling attackers to escalate privileges from local to SYSTEM. DIB organizations must ensure legacy Windows systems are patched or isolated, as this flaw represents a long-standing, avoidable risk that could be leveraged for lateral movement or ransomware deployment.
Shame score — A known, unpatched privilege escalation flaw exploited in the wild for over two decades, reflecting severe negligence in patch management and system hardening.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges.
"smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges."
"CVE-2002-0367: Microsoft Windows Privilege Escalation Vulnerability"
"CVE-2026-88097 1 Microsoft 1 Edge Chromium 2026-09-19 8.1 High Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally."
"CISA Known Exploited Vulnerabilities (KEV) catalog is the authoritative list of security flaws that have been confirmed exploited in real-world attacks."
"Microsoft CVE List (September 2026): Exploit-Ranked, Free | Senserva"
"Database CVE, CWE, CISA KEV & Vulnerability Intelligence | CVE Find"
"Top Exploited CVEs This Month — Actively Exploited Vulnerabilities"
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |