{"id":"CVE-2018-8440","published":"2018-09-13T00:29:04Z","modified":"2026-06-17T02:04:52Z","title":"Microsoft Windows Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka \"Windows ALPC Elevation of Privilege Vulnerability.\" This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an improper handling of calls to Advanced Local Procedure Call (ALPC) in Microsoft Windows, which allows privilege escalation. An attacker with local access and low-privilege credentials, requiring no user interaction, can elevate their privileges on the affected Windows system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:00:04Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.1853,"percentile":0.97239,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-28","dueDate":"2022-04-18","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8440","provenance":"source"},"vulncheckKev":{"dateAdded":"2018-09-05","exploitedFirstSeen":"2018-09-05","ransomware":true,"evidence":[{"url":"https://www.welivesecurity.com/2018/09/05/powerpool-malware-exploits-zero-day-vulnerability/","date":"2018-09-05"},{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2018-Sep","date":"2018-09-11"},{"url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/rapidly-evolving-ransomware-gandcrab-version-5-partners-with-crypter-service-for-obfuscation/","date":"2018-10-10"},{"url":"https://web.archive.org/web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf","date":"2019-09-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-28"},{"url":"https://static.tenable.com/marketing/whitepapers/Whitepaper-Ransomware_Ecosystem.pdf","date":"2022-06-22"},{"url":"https://asec.ahnlab.com/en/38156/","date":"2022-09-01"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/105153","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1041578","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://blog.0patch.com/2018/08/how-we-micropatched-publicly-dropped.html","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://blog.0patch.com/2018/09/comparing-our-micropatch-with.html","tags":["Third Party Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8440","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/105153","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1041578","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://blog.0patch.com/2018/08/how-we-micropatched-publicly-dropped.html","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://blog.0patch.com/2018/09/comparing-our-micropatch-with.html","tags":["Third Party Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8440","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8440","tags":["US Government Resource"]}],"techniques":[{"id":"T1608","name":"Stage Capabilities","tactics":["resource-development"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: local privilege escalation via ALPC exploitation","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"improperly handles calls to Advanced Local Procedure Call (ALPC)","start":60,"end":124}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-20076","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-20076","exploited":true,"exploitedSince":"2022-03-28","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2018-10-31","earliestUrl":"https://github.com/sourceincite/CVE-2018-8440","repos":[{"name":"sourceincite/CVE-2018-8440","url":"https://github.com/sourceincite/CVE-2018-8440","stars":80,"created":"2018-10-31"}]},"metasploit":[{"name":"Microsoft Windows ALPC Task Scheduler Local Privilege Elevation","module":"exploit/windows/local/alpc_taskscheduler","type":"exploit","disclosureDate":"2018-08-27","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/alpc_taskscheduler.rb"}],"first":{"date":"2018-08-27","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/alpc_taskscheduler.rb"},"provenance":"source"},"exploitRefs":["https://blog.0patch.com/2018/08/how-we-micropatched-publicly-dropped.html"],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"},{"stage":"related","techniques":["T1608"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2018-08-27","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2018-10-31","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/alpc_taskscheduler.rb","provenance":"source"},{"date":"2018-09-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.welivesecurity.com/2018/09/05/powerpool-malware-exploits-zero-day-vulnerability/","provenance":"source"},{"date":"2018-09-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8440","provenance":"source"},{"date":"2022-03-28","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-28","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-20076","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":1292},"priority":{"score":77.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2976 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.45,"detail":"percentile 0.9724"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}