CVE-2018-8414
Microsoft Windows Shell Remote Code Execution Vulnerability
Published Aug 15, 2018 · updated Jun 16, 2026 · microsoft windows 10 1703
A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Aug 15, 2018 · Catalog
Detected
A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10.
Mar 25, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Apr 15, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10.
Required action
Apply updates per vendor instructions.
CISA due date Apr 15, 2022
Affected
- cpe microsoft/windows 10 1703version unspecified
- cpe microsoft/windows 10 1709version unspecified
- cpe microsoft/windows 10 1803version unspecified
- cpe microsoft/windows server 1709version unspecified
- cpe microsoft/windows server 1803version unspecified
- vendor Microsoft Windowsversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2018-8414
A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.
cisa.gov - CVE.orgVulnerability recordCVE-2018-8414
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2018-8414
30-day exploitation probability 72.9%
first.org - NIST NVDVulnerability recordCVE-2018-8414
A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10.
nvd.nist.gov