ZeroDay Findings
Sign inSign up

Findings

CVE-2016-0099

Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability

Published Mar 9, 2016 · updated Jun 16, 2026 · microsoft windows 10 1507

The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."

Timeline

Detection, updates, and resolution for this record.

  1. Mar 9, 2016 · Catalog

    Detected

    The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."

  2. Mar 3, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Mar 24, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."

Required action

Apply updates per vendor instructions.

CISA due date Mar 24, 2022

Affected

  • cpe microsoft/windows 10 1507version unspecified
  • cpe microsoft/windows 10 1511version unspecified
  • cpe microsoft/windows 7version unspecified
  • cpe microsoft/windows 8.1version unspecified
  • cpe microsoft/windows server 2008version unspecified
  • cpe microsoft/windows server 2008r2
  • cpe microsoft/windows server 2012version unspecified
  • cpe microsoft/windows server 2012r2
  • vendor Microsoft Windowsversion unspecified

Sources

  • CISA KEVCVE-2016-0099

    A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator.

    cisa.gov
  • CVE.orgCVE-2016-0099

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2016-0099

    30-day exploitation probability 37.0%

    first.org
  • Exploit Database39719

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database39809

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database40107

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_windows/local/ms16_032_secondary_logon_handle_privesc

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2016-0099

    The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain pr

    nvd.nist.gov

References