COOEY // HUBcompliance · community · intelligence

Exposures › CVE-2018-8589

CVE-2018-8589

Severity
high · on CISA KEV actively exploited
Source
CISA-KEV · kev
Published
2022-05-23
Reference
https://nvd.nist.gov/vuln/detail/CVE-2018-8589
⌖ exploited in the wild shame 50/100 exploited-in-wild

A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.

Players implicated

Microsoft · vendorWin32k · product

Description

A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.

Affected FedRAMP products 4 in the catalog

ProductProviderStatusMatch
Azure Commercial Cloud Microsoft Authorized vendor-exact · 0.90
Azure Government (includes Dynamics 365) Microsoft Authorized vendor-exact · 0.90
Microsoft Office 365 GCC High Microsoft In Process vendor-exact · 0.90
Office 365 Multi-Tenant & Supporting Services Microsoft Authorized vendor-exact · 0.90