{"id":"CVE-2016-0099","published":"2016-03-09T11:59:09Z","modified":"2026-06-17T00:36:55Z","title":"Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka \"Secondary Logon Elevation of Privilege Vulnerability.\"","provenance":"source","from":"NVD"},"summary":{"text":"The Secondary Logon Service in Microsoft Windows, across several Vista, Server 2008, Windows 7, 8.1, Server 2012, RT 8.1 and Windows 10 releases, does not properly process request handles. A local user with low privileges can exploit this by running a crafted application to gain elevated privileges, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:28Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.37045,"percentile":0.98511,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0099","provenance":"source"},"vulncheckKev":{"dateAdded":"2018-06-01","exploitedFirstSeen":"2018-06-01","ransomware":true,"evidence":[{"url":"https://www.cyber.gov.au/sites/default/files/2023-03/report_manic_menagerie.pdf","date":"2018-06-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-03"},{"url":"https://go.group-ib.com/hubfs/report/protected/group-ib-opera1er-full-threat-research-2022-en.pdf","date":"2022-11-03"},{"url":"https://content.kaspersky-labs.com/fm/site-editor/33/3318ec849851138088d24f26d236f469/source/irreport.pdf","date":"2025-03-12"},{"url":"https://www.cybereason.com/hubfs/Consulting/TTP%20Briefing/Cybereason_TTP_Briefing_Jan-May-2025.pdf","date":"2025-06-29"},{"url":"https://www.acronis.com/en/tru/posts/makop-ransomware-guloader-and-privilege-escalation-in-attacks-against-indian-businesses/","date":"2025-12-08"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input"},{"id":"CWE-264","name":null}],"references":[{"url":"http://www.securityfocus.com/bid/84034","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1035210","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-032","tags":["Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/39574/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/39719/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/39809/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/40107/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/84034","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1035210","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-032","tags":["Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/39574/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/39719/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/39809/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/40107/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0099","tags":["US Government Resource"]}],"techniques":[{"id":"T1055","name":"Process Injection","tactics":["privilege-escalation","stealth"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: local privilege escalation via crafted application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"does not properly process request handles, which allows local users to gain privileges","start":202,"end":288}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1134","name":"Access Token Manipulation","tactics":["privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: yields elevated privileges via token manipulation","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows local users to gain privileges via a crafted application","start":251,"end":314}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2016-0137","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-0137","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[{"id":39574,"url":"https://www.exploit-db.com/exploits/39574","title":"Microsoft Windows 8.1/10 (x86) - Secondary Logon Standard Handles Missing Sanitization Privilege Escalation (MS16-032)","type":"local","platform":"windows_x86","date":"2016-03-21","verified":true,"provenance":"source"},{"id":39719,"url":"https://www.exploit-db.com/exploits/39719","title":"Microsoft Windows 7 < 10 / 2008 < 2012 R2 (x86/x64) - Local Privilege Escalation (MS16-032) (PowerShell)","type":"local","platform":"windows","date":"2016-04-21","verified":true,"provenance":"source"},{"id":39809,"url":"https://www.exploit-db.com/exploits/39809","title":"Microsoft Windows 7 < 10 / 2008 < 2012 (x86/x64) - Local Privilege Escalation (MS16-032)","type":"local","platform":"windows","date":"2016-04-25","verified":true,"provenance":"source"},{"id":40107,"url":"https://www.exploit-db.com/exploits/40107","title":"Microsoft Windows 7 < 10 / 2008 < 2012 (x86/x64) - Secondary Logon Handle Privilege Escalation (MS16-032) (Metasploit)","type":"local","platform":"windows","date":"2016-07-13","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":4,"earliest":"2016-03-21"},"pocGithub":{"count":1,"skipped":0,"earliest":"2017-03-15","earliestUrl":"https://github.com/zcgonvh/MS16-032","repos":[{"name":"zcgonvh/MS16-032","url":"https://github.com/zcgonvh/MS16-032","stars":83,"created":"2017-03-15"}]},"metasploit":[{"name":"MS16-032 Secondary Logon Handle Privilege Escalation","module":"exploit/windows/local/ms16_032_secondary_logon_handle_privesc","type":"exploit","disclosureDate":"2016-03-21","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms16_032_secondary_logon_handle_privesc.rb"}],"first":{"date":"2016-03-21","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/39574"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/39574/","https://www.exploit-db.com/exploits/39719/","https://www.exploit-db.com/exploits/39809/","https://www.exploit-db.com/exploits/40107/"],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"},{"stage":"primary","techniques":["T1134"],"provenance":"ai"},{"stage":"related","techniques":["T1055"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2016-03-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0099","provenance":"source"},{"date":"2016-03-21","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-39574); later: Metasploit 2016-03-21, PoC-in-GitHub 2017-03-15","url":"https://www.exploit-db.com/exploits/39574","provenance":"source"},{"date":"2018-06-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cyber.gov.au/sites/default/files/2023-03/report_manic_menagerie.pdf","provenance":"source"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-0137","provenance":"source"}],"speed":{"daysToPublicExploit":12,"firstExploitFrom":"Exploit-DB","daysToKev":2185},"priority":{"score":78.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3072 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.7,"detail":"percentile 0.9851"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 NVD references tagged Exploit; 4 Exploit-DB entries; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-264"}}