{"id":"CVE-2015-1769","kind":"vulnerability","aliases":["CVE-2015-1769"],"related":[],"title":"Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows…","description":"Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 mishandles symlinks, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka \"Mount Manager Elevation of Privilege Vulnerability.\"","summary":"Windows Mount Manager mishandles symbolic links, letting a local user raise their privileges. An attacker who already has a logon on the machine can gain SYSTEM-level control.","severity":"high","cvss":7.2,"epss":0.04078,"exploited":true,"exploited_at":"2022-05-25T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 7","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 8","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 8.1","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows rt","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows rt 8.1","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows vista","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","self-hosted","windows"],"not_affected_if":["non-windows","patched-windows"],"how_to_check":null,"fix":"Apply the Microsoft update for CVE-2015-1769 per vendor instructions (CISA required action); the specific KB number is unknown from the sources.","status":"open","published_at":"2015-08-15T00:59:01+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:15:40+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:15:40Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft update for CVE-2015-1769 per vendor instructions (CISA required action); the specific KB number is unknown from the sources.","reach":"local","impact":"high","summary":"Windows Mount Manager mishandles symbolic links, letting a local user raise their privileges. An attacker who already has a logon on the machine can gain SYSTEM-level control.","category":"infrastructure","who_cares":["windows","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains SYSTEM privileges on the Windows machine","analyst_note":"Find the affected Windows versions and the patch KB number in Microsoft's security bulletin for CVE-2015-1769 and add a check command.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-windows","non-windows"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000449,"input_tokens":2821,"output_tokens":334,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1769':23A,26A '-2015':22A,25A '10':31A,136C '2008':10A,51A,55A,111C '2012':59A,63A,125C '7':16A,34A,117C '8':19A,37A,120C '8.1':40A,47A,122C,133C 'aka':154C 'allow':140C 'alreadi':89B 'arbitrari':146C 'attack':87B,143C 'code':147C 'connect':149C 'control':101B 'craft':151C 'cve':21A,24A 'devic':153C 'elev':157C 'execut':145C 'exploit':67B 'gain':97B 'gold':126C,131C 'host':71B 'infrastructur':68B 'let':79B 'level':100B 'link':78B 'local':81B 'logon':92B 'machin':95B 'manag':2A,75B,103C,156C 'microsoft':4A,27A,29A,32A,35A,38A,41A,44A,48A,52A,56A,60A,64A,105C 'mishandl':76B,137C 'mount':1A,74B,102C,155C 'physic':141C 'privileg':85B,159C 'proxim':142C 'r2':13A,114C,128C 'rais':83B 'rt':43A,46A,130C 'self':70B 'self-host':69B 'server':9A,50A,54A,58A,62A,110C,124C 'sp1':14A,17A,115C,118C 'sp2':7A,11A,108C,112C 'symbol':77B 'symlink':138C 'system':99B 'system-level':98B 'usb':152C 'user':82B 'vista':6A,66A,107C 'vulner':160C 'window':5A,8A,15A,18A,20A,72B,73B,106C,109C,116C,119C,121C,123C,129C,135C 'windows':28A,30A,33A,36A,39A,42A,45A,49A,53A,57A,61A,65A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2015-08-15T00:59:01+00:00","kev":{"dateAdded":"2022-05-25","dueDate":"2022-06-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2015-1769","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-1769","severity":null,"published_at":"2022-05-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T19:35:24+00:00","note":null},{"source":"epss","external_id":"CVE-2015-1769","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-1769","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2015-1769","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1769","severity":null,"published_at":"2015-08-15T00:59:01+00:00","modified_at":"2026-06-17T00:22:57+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}