Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 9, 2016 · Catalog

   Detected

   The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."

2. Mar 3, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Mar 24, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."

Affected

• cpe microsoft/windows 10 1507version unspecified
• cpe microsoft/windows 10 1511version unspecified
• cpe microsoft/windows 7version unspecified
• cpe microsoft/windows 8.1version unspecified
• cpe microsoft/windows server 2008version unspecified
• cpe microsoft/windows server 2008r2
• cpe microsoft/windows server 2012version unspecified
• cpe microsoft/windows server 2012r2
• vendor Microsoft Windowsversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2016-0099

  A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator.

  cisa.gov
• CVE.orgVulnerability recordCVE-2016-0099

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2016-0099

  30-day exploitation probability 37.0%

  first.org
• Exploit DatabasePublic exploit reference39719

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Exploit DatabasePublic exploit reference39809

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Exploit DatabasePublic exploit reference40107

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Metasploit ModulesPublic exploit moduleexploit_windows/local/ms16_032_secondary_logon_handle_privesc

  Public module reference (normal). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDVulnerability recordCVE-2016-0099

  The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain pr

  nvd.nist.gov

References

• Broken Link · securityfocus.com
• Broken Link · securitytracker.com
• Patch · docs.microsoft.com
• CISA note · nvd.nist.gov
• Exploit · exploit-db.com
• Exploit · exploit-db.com
• Exploit · exploit-db.com
• Exploit · exploit-db.com