Security readout for executives and security teams
Plain-English summary
This is a legacy Windows NT local privilege escalation issue. A user who already has local access could alter the KnownDLLs configuration so Windows loads malicious programs, potentially gaining administrator privileges.
Executive priority
High priority only if Windows NT remains in use. For modern environments with no Windows NT assets, this is mainly a historical tracking item. The business risk is local users becoming administrators on legacy hosts.
Technical view
CVE-1999-0376 describes Windows NT allowing local users to change the KnownDLLs list to reference malicious programs. The reported impact is administrator privilege escalation. The provided sources do not include CVSS, CWE mapping, affected version granularity, or detailed remediation text beyond the Microsoft bulletin reference.
Likely exposure
Exposure appears limited to environments still running Windows NT systems matching the 1999 Microsoft advisory. The bundle does not identify specific supported products, versions, CPEs, or downstream affected software.
Exploitation context
The source bundle supports local exploitation only. There is no KEV listing and no provided evidence of active exploitation, public exploit use, remote exploitation, or unauthenticated attack paths.
Researcher notes
Evidence is sparse. The key facts are local access, KnownDLLs manipulation, and administrator privilege escalation on Windows NT. No CVSS, CWE, detailed affected versions, exploit maturity, or patch mechanics are provided in the bundle.
Mitigation direction
- Review Microsoft MS99-006 for vendor-specific corrective guidance.
- Inventory any Windows NT systems still present in the environment.
- Prioritize remediation or removal of exposed legacy Windows NT hosts.
- Restrict local user access where immediate remediation is unavailable.
- Monitor privileged account creation or unexpected administrator group changes.
Validation and detection
- Confirm whether any Windows NT assets remain in production or lab networks.
- Check whether systems fall under Microsoft MS99-006 guidance.
- Review local user permissions on any identified Windows NT hosts.
- Audit KnownDLLs-related configuration for unauthorized changes.
- Verify administrator group membership has not changed unexpectedly.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-1999-0376 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- MS99-006CVE reference · vendor-advisory, x_refsource_MS
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.