Skip to content
Fencer Intel
high 7.8

CVE-2016-0099 kev+ ransomware in the critical feed json

The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server…

published 2016-03-09 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-0137

cvss
7.8
version 3.1, CNA
cisa kev
Exploited
added 2022-03-03, used in ransomware
epss
37.0%
EPSS 37.0% chance of exploitation in 30 days, percentile 98%
public exploits
5
Metasploit, Exploit-DB

Summary

The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."

Patch / fix

cisa required action Apply updates per vendor instructions.

Timeline

  1. Published
  2. First public exploit (Metasploit exploit/windows/local/ms16_032_secondary_logon_handle_privesc)
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
4 y ago
Patch by
2022-03-24 (4 y ago)
Ransomware
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor, product
Microsoft, Windows
CISA name
Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability

Ransomware

Groups reported to have exploited it in intrusions.

  • BlackCat ransomware gang

reported by web.archive.org

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction

37.05% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/windows/local/ms16_032_secondary_logon_handle_privesc MS16-032 Secondary Logon Handle Privilege Escalation metasploit exploit, normal rank, 2016-03-21
  • EDB-40107 Microsoft Windows 7 < 10 / 2008 < 2012 (x86/x64) - Secondary Logon Handle Privilege Escalation (MS16-032) (Metasploit) local, 2016-07-13
  • EDB-39809 Microsoft Windows 7 < 10 / 2008 < 2012 (x86/x64) - Local Privilege Escalation (MS16-032) local, 2016-04-25
  • EDB-39719 Microsoft Windows 7 < 10 / 2008 < 2012 R2 (x86/x64) - Local Privilege Escalation (MS16-032) (PowerShell) local, 2016-04-21
  • EDB-39574 Microsoft Windows 8.1/10 (x86) - Secondary Logon Standard Handles Missing Sanitization Privilege Escalation (MS16-032) local, 2016-03-21

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.