{"schema":"threatline.record/2","record":{"id":"CVE-2016-0099","aliases":[],"summary":"Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability","details":"A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator.","categories":["Operating systems"],"product":"Windows","vendor":"Microsoft","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2016-0099","source_modified_at":"2025-10-21T23:55:54.947Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}],"defaultStatus":null}],"fixed_versions":[],"cvss":7.8,"severity":"High","kev":{"listed":true,"date_added":"2022-03-03","due_date":"2022-03-24","required_action":"Apply updates per vendor instructions.","ransomware_campaign_use":"Known"},"epss":{"probability":0.37045,"percentile":0.98518,"score_date":"2026-10-23"},"published_at":"2016-03-09T11:00:00.000Z","modified_at":"2025-10-21T23:55:54.947Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2016-0099","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-10-21T23:55:54.947Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms16_032_secondary_logon_handle_privesc.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2016-03-21"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/39809","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2016-04-25"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/40107","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2016-07-13"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/39719","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2016-04-21"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/39574","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2016-03-21"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-0099","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","Metasploit","Exploit-DB","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0099","source":"CISA KEV"},{"source":"CVE List","url":"https://www.exploit-db.com/exploits/40107/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"source":"CVE List","url":"https://www.exploit-db.com/exploits/39719/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"source":"CVE List","url":"https://www.exploit-db.com/exploits/39809/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"source":"CVE List","url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-032","tags":["vendor-advisory","x_refsource_MS","x_transferred"]},{"source":"CVE List","url":"https://www.exploit-db.com/exploits/39574/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0099","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"active","automatable":"no","technical_impact":"total","assessed_at":"2025-02-10T16:57:17.789636Z"},"exploits":[{"source":"Metasploit","kind":"Exploit module","name":"MS16-032 Secondary Logon Handle Privilege Escalation","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms16_032_secondary_logon_handle_privesc.rb","date":"2016-03-21","added":"2026-04-22","check":true},{"source":"Exploit-DB","kind":"Local exploit","name":"Microsoft Windows 7 < 10 / 2008 < 2012 (x86/x64) - Local Privilege Escalation (MS16-032)","url":"https://www.exploit-db.com/exploits/39809","date":"2016-04-25","added":"2016-04-25","verified":true},{"source":"Exploit-DB","kind":"Local exploit","name":"Microsoft Windows 7 < 10 / 2008 < 2012 (x86/x64) - Secondary Logon Handle Privilege Escalation (MS16-032) (Metasploit)","url":"https://www.exploit-db.com/exploits/40107","date":"2016-07-13","added":"2016-07-13","verified":true},{"source":"Exploit-DB","kind":"Local exploit","name":"Microsoft Windows 7 < 10 / 2008 < 2012 R2 (x86/x64) - Local Privilege Escalation (MS16-032) (PowerShell)","url":"https://www.exploit-db.com/exploits/39719","date":"2016-04-21","added":"2016-04-21","verified":true},{"source":"Exploit-DB","kind":"Local exploit","name":"Microsoft Windows 8.1/10 (x86) - Secondary Logon Standard Handles Missing Sanitization Privilege Escalation (MS16-032)","url":"https://www.exploit-db.com/exploits/39574","date":"2016-03-21","added":"2016-03-21","verified":true}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2025-10-21T23:55:54.947Z","content_hash":"544411d003b60881288a134ea68a08ae8d0e2c40e58ece5998b990b8c5de6e21"}}