{"id":"CVE-2018-8589","kind":"vulnerability","aliases":["CVE-2018-8589"],"related":[],"title":"Microsoft Win32k: Microsoft Win32k Privilege Escalation Vulnerability","description":"A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.\n\nCISA required action: Apply updates per vendor instructions.","summary":"A flaw in Windows Win32k.sys mishandles calls, letting a local user escalate privileges. An attacker who exploits it runs code as the local SYSTEM account.","severity":"high","cvss":7.8,"epss":0.03023,"exploited":true,"exploited_at":"2022-05-23T00:00:00+00:00","products":[{"name":"Microsoft Win32k","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","self-hosted","windows"],"not_affected_if":["patched-windows"],"how_to_check":null,"fix":"Apply the Microsoft update for CVE-2018-8589 per vendor instructions (CISA KEV required action).","status":"open","published_at":"2018-11-14T01:29:02+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:16:09+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:16:09Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft update for CVE-2018-8589 per vendor instructions (CISA KEV required action).","reach":"local","impact":"high","summary":"A flaw in Windows Win32k.sys mishandles calls, letting a local user escalate privileges. An attacker who exploits it runs code as the local SYSTEM account.","category":"infrastructure","who_cares":["windows","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Local attacker gains SYSTEM code execution on the Windows machine.","analyst_note":"Confirm the patched Windows build and KB number from the Microsoft advisory for CVE-2018-8589 and add a detection check.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-windows"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000444,"input_tokens":2846,"output_tokens":319,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2018':9A,12A '-8589':10A,13A 'account':46B 'action':80C 'appli':81C 'attack':36B,60C 'call':28B,56C 'cisa':78C 'code':41B,69C 'context':73C 'could':66C 'cve':8A,11A 'escal':6A,33B,49C 'exist':51C 'exploit':16B,38B,63C 'flaw':23B 'handl':55C 'host':20B 'improp':54C 'infrastructur':17B 'instruct':85C 'let':29B 'local':31B,44B,76C 'microsoft':1A,3A,14A 'mishandl':27B 'per':83C 'privileg':5A,34B,48C 'remot':68C 'requir':79C 'run':40B,67C 'secur':72C 'self':19B 'self-host':18B 'success':62C 'system':45B,77C 'updat':82C 'user':32B 'vendor':84C 'vulner':7A,50C,65C 'win32k':2A,4A,15A 'win32k.sys':26B,58C 'window':21B,25B,53C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-11-14T01:29:02+00:00","kev":{"dateAdded":"2022-05-23","dueDate":"2022-06-13","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-8589","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-8589","severity":null,"published_at":"2022-05-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"epss","external_id":"CVE-2018-8589","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8589","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-8589","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8589","severity":null,"published_at":"2018-11-14T01:29:02+00:00","modified_at":"2026-06-17T02:05:09+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}