CVE-2016-0099

CVE-2016-0099 is a high-severity vulnerability in Microsoft Windows 10 1507 with a CVSS 3.x base score of 7.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2022-03-03). The underlying weakness is classified as CWE-120.

Key facts

Description

The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."

CVE-2016-0099: Secondary Logon Service Local Privilege Elevation

AI-generated analysis based on the vulnerability data on this page.

Summary

CVE-2016-0099 is a local privilege escalation vulnerability in the Windows Secondary Logon Service. An attacker with local access can craft a malicious request to improperly manipulate service handles, resulting in elevated privileges on the affected system.

Background

The Secondary Logon Service (seclogon) enables processes to start under alternate user credentials. It is a standard Windows component that facilitates credential separation and administrative workflows. When a process requests a new logon session through this service, the service creates and manages handles that represent the resulting process and thread objects.

Root Cause

The vulnerability is classified as CWE-120. The Secondary Logon Service fails to properly validate and process request handles during credential transition operations. This improper handle processing allows an attacker to manipulate memory structures and corrupt the service's internal state, leading to unauthorized privilege escalation.

Impact

This vulnerability scores 7.2 on the CVSS v2 scale (AV:L/AC:L/Au:N/C:C/I:C/A:C) and 7.8 on CVSS v3.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the attack vector is local, an attacker must already have a foothold on the target system. However, the impact is severe: successful exploitation grants complete control over confidentiality, integrity, and availability. Both CVSS v2 and v3.1 rate the impact as complete or high across all three security attributes.

Exploitation Walkthrough

An attacker with local access and low privileges can trigger this vulnerability by interacting with the Secondary Logon Service API and submitting a crafted request containing malformed handle parameters. The service's failure to properly process these handles results in memory corruption that can be leveraged to execute arbitrary code in a higher-privilege context.

Ethics caveat: This description is for defensive awareness only. The specifics required to weaponize this vulnerability are intentionally omitted.

Affected and Patched Versions

The following Windows versions are affected:

  • Windows Vista SP2
  • Windows Server 2008 SP2 and R2 SP1
  • Windows 7 SP1
  • Windows 8.1
  • Windows Server 2012 and R2
  • Windows RT 8.1
  • Windows 10 (versions 1507 and 1511)

Microsoft addressed this vulnerability in Security Bulletin MS16-032, released in March 2016. Systems that have not applied this update remain vulnerable.

Remediation

  1. Apply the patch: Install Microsoft Security Bulletin MS16-032 on all affected systems.
  2. Upgrade: Migrate from end-of-life operating systems such as Windows Vista and Windows Server 2008 to supported versions.
  3. Compensating controls: Restrict local access to systems to authorized users only. Enforce the principle of least privilege so that standard users cannot run untrusted applications. Use endpoint protection to detect anomalous handle manipulation attempts.

Detection

Monitor Windows Event Logs for anomalous Secondary Logon Service activity. Look for unexpected process creation events with elevated privileges originating from low-integrity user sessions. Endpoint detection and response (EDR) tools can flag suspicious handle operations or privilege escalation attempts targeting system services.

Assessment

With an EPSS score of 0.37164 (37.16%) and a percentile of 0.98332, this vulnerability ranks in the top 2% of all CVEs by probability of exploitation. The CISA Known Exploited Vulnerabilities catalog added CVE-2016-0099 on 2022-03-03, confirming active exploitation in the wild. Two key lessons emerge: first, legacy Windows endpoints remain high-risk targets long after patch availability; second, service handle validation is a critical surface for privilege escalation research.

References

Frequently asked questions

What is CVE-2016-0099?
The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."
How severe is CVE-2016-0099?
CVE-2016-0099 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2016-0099 being actively exploited?
Yes. CVE-2016-0099 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2022-03-03, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2016-0099?
CVE-2016-0099 primarily affects Microsoft Windows 10 1507. In total, 9 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2016-0099?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2016-0099 have an EU (EUVD) identifier?
Yes. CVE-2016-0099 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2016-0137. It is also flagged as exploited in the EUVD (since 2022-03-03).
When was CVE-2016-0099 published?
CVE-2016-0099 was published on 2016-03-09 and last updated on 2026-06-17.

References

Affected products (9)

More vulnerabilities in Microsoft Windows 10 1507

All CVEs affecting Microsoft Windows 10 1507 →

Other CWE-120 (Classic Buffer Overflow) vulnerabilities

Browse all CWE-120 (Classic Buffer Overflow) vulnerabilities →