{"id":"CVE-2017-0213","kind":"vulnerability","aliases":["CVE-2017-0213"],"related":[],"title":"Microsoft Windows: Microsoft Windows Privilege Escalation Vulnerability","description":"Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka \"Windows COM Elevation of Privilege Vulnerability\". This CVE ID is unique from CVE-2017-0214.","summary":"Microsoft Windows COM Aggregate Marshaler has a flaw that lets a local attacker raise their privileges by running a specially crafted application. It is listed as exploited in the wild and used in ransomware campaigns.","severity":"high","cvss":7.3,"epss":0.84258,"exploited":true,"exploited_at":"2022-03-28T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ransomware","windows"],"not_affected_if":["fully-patched-windows"],"how_to_check":null,"fix":"Apply the Microsoft Windows updates per vendor instructions; the specific patch build is unknown from the sources.","status":"open","published_at":"2017-05-12T14:29:01+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:19:42+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:19:42Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft Windows updates per vendor instructions; the specific patch build is unknown from the sources.","reach":"local","impact":"high","summary":"Microsoft Windows COM Aggregate Marshaler has a flaw that lets a local attacker raise their privileges by running a specially crafted application. It is listed as exploited in the wild and used in ransomware campaigns.","category":"infrastructure","who_cares":["windows"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the Microsoft security bulletin for CVE-2017-0213 and list the affected Windows builds and patch KB numbers, which the sources do not give.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["fully-patched-windows"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000449,"input_tokens":2827,"output_tokens":332,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0213':10A,13A '-0214':121C '-2017':9A,12A,120C '10':83C '1511':85C '1607':86C '1703':88C '2008':63C '2012':75C '2016':92C '7':69C '8.1':72C,81C 'aggreg':23B,57C 'aka':106C 'allow':93C 'applic':41B,105C 'attack':32B,100C 'campaign':54B 'com':22B,56C,108C 'craft':40B,104C 'cve':8A,11A,114C,119C 'elev':95C,109C 'escal':6A 'exploit':16B,46B 'flaw':27B 'gold':76C,84C 'id':115C 'infrastructur':17B 'let':29B 'list':44B 'local':31B 'marshal':24B,58C 'microsoft':1A,3A,14A,20B,60C 'privileg':5A,35B,96C,111C 'r2':66C,78C 'rais':33B 'ransomwar':18B,53B 'rt':80C 'run':37B,101C 'server':62C,74C,91C 'sp1':67C,70C 'sp2':64C 'special':39B,103C 'uniqu':117C 'use':51B 'vulner':7A,97C,112C 'wild':49B 'window':2A,4A,19B,21B,55C,61C,68C,71C,73C,79C,82C,90C,107C 'windows':15A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-05-12T14:29:01+00:00","kev":{"dateAdded":"2022-03-28","dueDate":"2022-04-18","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-0213","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0213","severity":null,"published_at":"2022-03-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2017-0213","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0213","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-0213","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0213","severity":null,"published_at":"2017-05-12T14:29:01+00:00","modified_at":"2026-06-17T00:57:16+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}