CVE-2018-8440
Microsoft Windows Privilege Escalation Vulnerability
Description
CVE-2018-8440 is a critical privilege escalation vulnerability in the Windows Advanced Local Procedure Call (ALPC) interface that allows a locally authenticated attacker to execute code with SYSTEM-level privileges. The vulnerability stems from improper handling of ALPC calls by the Windows Task Scheduler, specifically in the SchRpcSetSecurity API endpoint. CISA added CVE-2018-8440 to the Known Exploited Vulnerabilities catalog on March 28, 2022, confirming widespread exploitation. With an EPSS score of 97.3% (99.9th percentile), this is one of the most heavily exploited Windows privilege escalation vulnerabilities, with documented use by the PowerPool malware group and other threat actors.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1703 | - |
| microsoft | windows 10 1709 | - |
| microsoft | windows 10 1803 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/105153(Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1041578(Third Party Advisory, VDB Entry)
- https://blog.0patch.com/2018/08/how-we-micropatched-publicly-dropped.html(Exploit, Patch, Third Party Advisory)
- https://blog.0patch.com/2018/09/comparing-our-micropatch-with.html(Third Party Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8440(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8440(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
CWE-269 describes a weakness where software does not properly manage privileges, allowing attackers to gain elevated access to resources that are normally protected. In CVE-2018-8440, the Windows ALPC interface in the Task Scheduler service improperly handles privilege checks on SchRpcSetSecurity calls, allowing a low-privileged user to overwrite protected files and achieve SYSTEM-level code execution.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2018-8440 enables local privilege escalation from any authenticated user to SYSTEM on affected Windows systems, representing a complete compromise of the local system security boundary. The vulnerability is particularly dangerous because it targets the Windows Task Scheduler ALPC interface, which is present on all Windows systems from Windows 7 through Windows 10 and corresponding Server editions. Successful exploitation gives the attacker unrestricted access to all system resources, the ability to install persistent backdoors, and control over security mechanisms including antivirus and logging. The documented use by the PowerPool threat group and the 99.9th percentile EPSS score confirm that this vulnerability is a standard tool in real-world attack arsenals.
Exploit Maturity
CVE-2018-8440 has extremely mature exploit availability, with public proof-of-concept code released prior to the Microsoft patch (a zero-day disclosure). The PowerPool threat group was observed exploiting this vulnerability within days of the public disclosure in August 2018, and CISA added it to the KEV catalog on March 28, 2022. The EPSS score of 97.3% (99.9th percentile) reflects near-universal exploitation activity. Multiple exploit frameworks include modules for this vulnerability, and the exploitation technique is well-documented in security research.
Remediation
- Apply the Microsoft security update from September 2018 (KB4457131 and related updates) that patches the ALPC vulnerability in the Windows Task Scheduler across all affected Windows versions.
- Ensure all Windows systems are enrolled in automatic Windows Update to prevent missing critical security patches for exploited vulnerabilities.
- Implement application whitelisting and endpoint detection and response (EDR) solutions to detect and block privilege escalation attempts targeting the Task Scheduler ALPC interface.
- Restrict local logon rights and enforce the principle of least privilege to minimize the number of accounts that could be used as a starting point for privilege escalation.
- Monitor for indicators of compromise associated with the PowerPool threat group and other actors known to exploit CVE-2018-8440.
Technical Details
CVE-2018-8440 exploits a flaw in the Windows Task Scheduler's Advanced Local Procedure Call (ALPC) interface, specifically in the SchRpcSetSecurity API function. The vulnerability allows a low-privileged local user to call SchRpcSetSecurity to set a hard link to a protected system file, bypassing normal DACL checks because the Task Scheduler service runs as SYSTEM and performs the file operation with SYSTEM privileges. By creating a hard link to a target DLL and then triggering the Task Scheduler to overwrite it, an attacker can replace a system binary with malicious code that executes with SYSTEM privileges. The exploit was publicly disclosed as a zero-day in August 2018 before Microsoft released a patch in September 2018, giving attackers a window of active exploitation.
Frequently Asked Questions
Is CVE-2018-8440 being actively exploited?
Yes, CVE-2018-8440 has been extensively exploited in the wild since its disclosure as a zero-day in August 2018. The PowerPool malware group was among the first to weaponize this vulnerability, and CISA confirmed active exploitation by adding it to the KEV catalog. The EPSS score of 97.3% (99.9th percentile) reflects near-universal exploitation.
What systems are affected by CVE-2018-8440?
CVE-2018-8440 affects Windows 7, Windows 8.1, Windows 10, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 — essentially all actively used Windows versions at the time of disclosure. All systems without the September 2018 security update are vulnerable.
How do I fix CVE-2018-8440?
Apply the Microsoft September 2018 security update (Patch Tuesday) that addresses the ALPC vulnerability in the Windows Task Scheduler. Ensure all Windows systems are enrolled in automatic updates. Deploy EDR solutions to detect privilege escalation attempts.
How severe is CVE-2018-8440?
CVE-2018-8440 is a critical privilege escalation vulnerability with an EPSS score in the 99.9th percentile. It was disclosed as a zero-day, exploited by the PowerPool threat group within days, and enables any local user to gain SYSTEM access. Its widespread exploitation, mature exploit code, and universal Windows applicability make it one of the most significant privilege escalation vulnerabilities in the Windows ecosystem.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.