CVE-2015-2528 json
Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not properly constrain impers…
published 2015-09-09 11 y ago modified 2026-06-17 4 mo ago also EUVD-2015-2621
- cvss
- 7.2
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.3%
- EPSS 3.3% chance of exploitation in 30 days, percentile 88%
- public exploits
- 1
- Exploit-DB
Summary
Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows Task Management Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2524.
Patch / fix
Timeline
- Published
- First public exploit (EDB-38201)
Exploit prediction
3.34% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-38201 Microsoft Windows - CreateObjectTask TileUserBroker Privilege Escalation local, 2015-09-15
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-264 Permissions, Privileges, and Access Controls
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2015/ms15-102
vendor-advisory, patch
-
exploit-db.com
/exploits/38201/
exploit, third-party-advisory, vdb-entry
-
securitytracker.com
/id/1033494
vdb-entry, third-party-advisory
- packetstormsecurity.com /files/159109/Microsoft-Windows-CloudExperienceHostBroker-Privilege-Escalation.html
Sources
- CVE List CVE-2015-2528
- NVD CVE-2015-2528
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.