CVE-2018-8589

Status: AnalyzedHigh (7.8)⚠ Active exploitation

An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base score: 7.8

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 3.02%
Percentile among all scored CVEs: 87
Score date: 10/9/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

CISA KEV — actively exploited

Added to catalog: 5/23/2022
Remediation due date: 6/13/2022
Known ransomware use: Unknown

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1068 Exploitation for Privilege Escalationprivilege escalation95 %
Secondary impactT1548 Abuse Elevation Control Mechanismprivilege escalation80 %

Vulnerabilidad de escalada de privilegios en Win32k.sys con acceso local requerido (AV:L, PR:L). Permite ejecución con privilegios elevados tras la explotación T1068.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Execution Prevention Update Software User Account Management Threat Intelligence Program Restrict File and Directory Permissions Privileged Account Management

Affected technologies (2)

Microsoft — Windows 7 Microsoft — Windows Server 2008

CWEs

NVD-CWE-noinfo

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2018-8589",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2018-8589",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-07T16:23:58.282862Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Windows Server 2008",
          "versions": [
            {
              "status": "affected",
              "version": "32-bit Systems Service Pack 2"
            },
            {
              "status": "affected",
              "version": "32-bit Systems Service Pack 2 (Server Core installation)"
            },
            {
              "status": "affected",
              "version": "Itanium-Based Systems Service Pack 2"
            },
            {
              "status": "affected",
              "version": "x64-based Systems Service Pack 2"
            },
            {
              "status": "affected",
              "version": "x64-based Systems Service Pack 2 (Server Core installation)"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Windows 7",
          "versions": [
            {
              "status": "affected",
              "version": "32-bit Systems Service Pack 1"
            },
            {
              "status": "affected",
              "version": "x64-based Systems Service Pack 1"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Windows Server 2008 R2",
          "versions": [
            {
              "status": "affected",
              "version": "Itanium-Based Systems Service Pack 1"
            },
            {
              "status": "affected",
              "version": "x64-based Systems Service Pack 1"
            },
            {
              "status": "affected",
              "version": "x64-based Systems Service Pack 1 (Server Core installation)"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-11-14T01:29:02.067",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/105796",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1042140",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8589",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/105796",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1042140",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8589",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8589",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka \"Windows Win32k Elevation of Privilege Vulnerability.\" This affects Windows Server 2008, Windows 7, Windows Server 2008 R2."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de elevación de privilegios cuando Windows gestiona incorrectamente las llamadas a Win32k.sys. Esto también se conoce como \"Windows Win32k Elevation of Privilege Vulnerability\". Esto afecta a Windows Server 2008, Windows 7 y Windows Server 2008 R2."
    }
  ],
  "lastModified": "2026-06-17T02:05:09.510",
  "cisaActionDue": "2022-06-13",
  "cisaExploitAdd": "2022-05-23",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2B1C231-DE19-4B8F-A4AA-5B3A65276E46"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F422A8C-2C4E-42C8-B420-E0728037E15C"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*",
              "vulnerable": true,
              "matchCriteriaId": "B320A104-9037-487E-BC9A-62B4A6B49FD0"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "AF07A81D-12E5-4B1D-BFF9-C8D08C32FF4F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Microsoft Win32k Privilege Escalation Vulnerability"
}