{"id":"CVE-2017-0101","kind":"vulnerability","aliases":["CVE-2017-0101"],"related":[],"title":"Microsoft Windows: Microsoft Windows Transaction Manager Privilege Escalation Vulnerability","description":"The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allow local users to gain privileges via a crafted application, aka \"Windows Elevation of Privilege Vulnerability.\"","summary":"Windows Transaction Manager mishandles objects in memory, letting a local user raise their privileges. An attacker who already has a foothold on the machine can gain SYSTEM-level control.","severity":"high","cvss":7.8,"epss":0.57482,"exploited":true,"exploited_at":"2022-03-15T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ransomware","self-hosted","windows"],"not_affected_if":["fully-patched-windows"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2017-0101 per vendor instructions (CISA required action); the specific KB number is not in the sources.","status":"open","published_at":"2017-03-17T00:59:02+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:22:12+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:22:12Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2017-0101 per vendor instructions (CISA required action); the specific KB number is not in the sources.","reach":"local","impact":"high","summary":"Windows Transaction Manager mishandles objects in memory, letting a local user raise their privileges. An attacker who already has a foothold on the machine can gain SYSTEM-level control.","category":"infrastructure","who_cares":["windows","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"local user gains SYSTEM privileges on the Windows machine","analyst_note":"Find the Microsoft bulletin for CVE-2017-0101 and list affected Windows builds and KB numbers so teams can check patch status.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["fully-patched-windows"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00045,"input_tokens":2827,"output_tokens":334,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0101':12A,15A '-2017':11A,14A '10':89C '1511':91C '1607':93C '2008':70C '2012':81C '2016':97C '7':75C '8.1':78C,87C 'aka':108C 'allow':98C 'alreadi':42B 'applic':107C 'attack':40B 'control':54B 'craft':106C 'cve':10A,13A 'driver':59C 'elev':110C 'escal':8A 'exploit':18B 'foothold':45B 'gain':50B,102C 'gold':82C,90C 'host':23B 'infrastructur':19B 'kernel':57C 'kernel-mod':56C 'let':32B 'level':53B 'local':34B,99C 'machin':48B 'manag':6A,27B,62C 'memori':31B 'microsoft':1A,3A,16A,64C 'mishandl':28B 'mode':58C 'object':29B 'privileg':7A,38B,103C,112C 'r2':73C,84C 'rais':36B 'ransomwar':20B 'rt':86C 'self':22B 'self-host':21B 'server':69C,80C,96C 'sp1':76C 'sp2':67C,71C 'system':52B 'system-level':51B 'transact':5A,26B,61C 'user':35B,100C 'via':104C 'vista':66C 'vulner':9A,113C 'window':2A,4A,24B,25B,65C,68C,74C,77C,79C,85C,88C,95C,109C 'windows':17A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-03-17T00:59:02+00:00","kev":{"dateAdded":"2022-03-15","dueDate":"2022-04-05","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-0101","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0101","severity":null,"published_at":"2022-03-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:32+00:00","note":null},{"source":"epss","external_id":"CVE-2017-0101","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0101","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-0101","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0101","severity":null,"published_at":"2017-03-17T00:59:02+00:00","modified_at":"2026-06-17T00:57:04+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}