CVE-2016-0099

7.8 HIGH CISA KEV - Actively Exploited
Published: March 09, 2016 Modified: October 22, 2025
View on NVD

Description

The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://www.securityfocus.com/bid/84034
Source: secure@microsoft.com
Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1035210
Source: secure@microsoft.com
Broken Link Third Party Advisory VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-032
Source: secure@microsoft.com
Patch Vendor Advisory
https://www.exploit-db.com/exploits/39574/
Source: secure@microsoft.com
Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/39719/
Source: secure@microsoft.com
Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/39809/
Source: secure@microsoft.com
Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/40107/
Source: secure@microsoft.com
Exploit Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/84034
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1035210
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link Third Party Advisory VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-032
Source: af854a3a-2127-422b-91ae-364da2661108
Patch Vendor Advisory
https://www.exploit-db.com/exploits/39574/
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/39719/
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/39809/
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/40107/
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0099
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

15 reference(s) from NVD

Quick Stats

CVSS v3 Score
7.8 / 10.0
EPSS (Exploit Probability)
91.7%
100th percentile
Exploitation Status
Actively Exploited
Remediation due: 2022-03-24

Weaknesses (CWE)

CWE-120 CWE-120

Affected Vendors

microsoft

Related CVEs

CVE-2025-52691 10.0
CVE-2025-15168 7.3
CVE-2025-15167 7.3
CVE-2025-15166 7.3
CVE-2025-15165 7.3