CVE-2018-8134
Status: ModifiedHigh (7)—💥 Exploit
An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.
CVSS
- Version: 3.0
- Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Base score: 7
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 2.99%
- Percentile among all scored CVEs: 87
- Score date: 10/9/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
💥 Public exploits
Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.
- Published on Exploit-DB · Microsoft Windows - Token Process Trust SID Access Check Bypass Privilege Escalation (5/16/2018)
Affected technologies (6)
CWEs
- NVD-CWE-noinfo
References
- http://www.securityfocus.com/bid/104041
- http://www.securitytracker.com/id/1040849
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8134
- https://www.exploit-db.com/exploits/44630/
- http://www.securityfocus.com/bid/104041
- http://www.securitytracker.com/id/1040849
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8134
- https://www.exploit-db.com/exploits/44630/
Raw JSON (NVD)
Show
{
"id": "CVE-2018-8134",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.9,
"accessVector": "LOCAL",
"vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.4,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 7,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1
}
]
},
"affected": [
{
"source": "secure@microsoft.com",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Windows Server 2012 R2",
"versions": [
{
"status": "affected",
"version": "(Server Core installation)"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows RT 8.1",
"versions": [
{
"status": "affected",
"version": "Windows RT 8.1"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows Server 2016",
"versions": [
{
"status": "affected",
"version": "(Server Core installation)"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows 8.1",
"versions": [
{
"status": "affected",
"version": "32-bit systems"
},
{
"status": "affected",
"version": "x64-based systems"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows 10",
"versions": [
{
"status": "affected",
"version": "32-bit Systems"
},
{
"status": "affected",
"version": "Version 1607 for 32-bit Systems"
},
{
"status": "affected",
"version": "Version 1607 for x64-based Systems"
},
{
"status": "affected",
"version": "Version 1703 for 32-bit Systems"
},
{
"status": "affected",
"version": "Version 1703 for x64-based Systems"
},
{
"status": "affected",
"version": "Version 1709 for 32-bit Systems"
},
{
"status": "affected",
"version": "Version 1709 for x64-based Systems"
},
{
"status": "affected",
"version": "Version 1803 for 32-bit Systems"
},
{
"status": "affected",
"version": "Version 1803 for x64-based Systems"
},
{
"status": "affected",
"version": "x64-based Systems"
}
]
},
{
"vendor": "Microsoft",
"product": "Windows 10 Servers",
"versions": [
{
"status": "affected",
"version": "version 1709 (Server Core Installation)"
},
{
"status": "affected",
"version": "version 1803 (Server Core Installation)"
}
]
}
]
}
],
"published": "2018-05-09T19:29:01.793",
"references": [
{
"url": "http://www.securityfocus.com/bid/104041",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "secure@microsoft.com"
},
{
"url": "http://www.securitytracker.com/id/1040849",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "secure@microsoft.com"
},
{
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8134",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "secure@microsoft.com"
},
{
"url": "https://www.exploit-db.com/exploits/44630/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "secure@microsoft.com"
},
{
"url": "http://www.securityfocus.com/bid/104041",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1040849",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8134",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.exploit-db.com/exploits/44630/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka \"Windows Elevation of Privilege Vulnerability.\" This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de elevación de privilegios por la forma en la que la API del kernel de Windows aplica los permisos. Esto también se conoce como \"Windows Elevation of Privilege Vulnerability\". Esto afecta a Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10 y Windows 10 Servers."
}
],
"lastModified": "2026-06-17T02:04:19.690",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21540673-614A-4D40-8BD7-3F07723803B0"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E01A4CCA-4C43-46E0-90E6-3E4DBFBACD64"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AEE2E768-0F45-46E1-B6D7-087917109D98"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "83B14968-3985-43C3-ACE5-8307196EFAE3"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7CB85C75-4D35-480E-843D-60579EC75FCB"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7519928D-0FF2-4584-8058-4C7764CD5671"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A7F51B5F-AA19-4D31-89FA-6DFAC4BA8F0F"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "197E82CB-81AF-40F1-A55C-7B596891A783"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF6437F9-6631-49D3-A6C2-62329E278E31"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:1709:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5B454BFE-D3AB-4CDC-B79B-F60EA3F57DBA"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CAACE735-003E-4ACB-A82E-C0CF97D7F013"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secure@microsoft.com"
}