Security readout for executives and security teams
Plain-English summary
This is a Windows privilege-escalation flaw in the Secondary Logon Service. An attacker who already has local user-level access could run a crafted application to gain higher privileges. CISA KEV listing means known exploitation is supported by a government source.
Executive priority
Treat as high priority where legacy Windows remains in service. Because CISA KEV confirms known exploitation, remediation should be tracked with clear ownership, especially on systems where local compromise could lead to domain or production impact.
Technical view
CVE-2016-0099 affects multiple legacy Windows client and server releases. The service mishandles request handles, enabling local elevation of privilege. CVSS 3.1 is 7.8: local attack, low complexity, low privileges required, no user interaction, with high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely on unpatched or unsupported Windows Vista, Server 2008, Windows 7, Windows 8.1, Server 2012, RT 8.1, and early Windows 10 builds listed in the CVE description.
Exploitation context
The bundle includes CISA KEV status and multiple Exploit-DB references, so exploitation risk is real. Evidence supports local privilege escalation, not remote unauthenticated compromise. Attackers would generally need an existing foothold or ability to run code locally.
Researcher notes
The available bundle identifies CWE-120 and a Secondary Logon request-handle processing flaw. Public exploit references exist, but this assessment does not rely on exploit mechanics. Validate patch state first, then assess whether local execution paths exist for lower-privileged users.
Mitigation direction
- Apply Microsoft guidance and security updates from MS16-032 or superseding updates.
- Prioritize internet-facing, shared, kiosk, VDI, and high-value legacy Windows systems.
- Retire or isolate unsupported Windows versions where updates are unavailable.
- Limit local user rights and interactive logon access on affected systems.
- Review endpoint controls for suspicious privilege escalation from standard user contexts.
Validation and detection
- Inventory hosts running the Windows versions named in the CVE description.
- Verify MS16-032 or applicable superseding Windows updates are installed.
- Check vulnerability scanner results against CVE-2016-0099 and MS16-032.
- Confirm CISA KEV tracking reflects this CVE in remediation queues.
- Review EDR and Windows logs for unexpected privilege changes on legacy hosts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2016-0099 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- 40107CVE reference · exploit, x_refsource_EXPLOIT-DB
- 39719CVE reference · exploit, x_refsource_EXPLOIT-DB
- 39809CVE reference · exploit, x_refsource_EXPLOIT-DB
- MS16-032CVE reference · vendor-advisory, x_refsource_MS
- 39574CVE reference · exploit, x_refsource_EXPLOIT-DB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0099CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.