{"id":"CVE-2014-1812","published":"2014-05-14T11:13:06Z","modified":"2026-06-17T00:05:35Z","title":"Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle distribution of passwords, which allows remote authenticated users to obtain sensitive credential information and consequently gain privileges by leveraging access to the SYSVOL share, as exploited in the wild in May 2014, aka \"Group Policy Preferences Password Elevation of Privilege Vulnerability.\"","provenance":"source","from":"NVD"},"summary":{"text":"The Group Policy implementation in Microsoft Windows (including Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, 8.1, and Server 2012) does not properly handle distribution of passwords, leaving credentials stored in Group Policy Preferences exposed. A remote attacker who already holds valid domain credentials can read those credentials through the SYSVOL share and use them to gain elevated privileges, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:59:28Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.65117,"percentile":0.9925,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-1812","provenance":"source"},"vulncheckKev":{"dateAdded":"2014-05-13","exploitedFirstSeen":"2014-05-13","ransomware":true,"evidence":[{"url":"https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2014/ms14-025","date":"2014-05-13"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-1812","date":"2014-05-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://media.defense.gov/2024/Sep/25/2003553985/-1/-1/0/CTR-DETECTING-AND-MITIGATING-AD-COMPROMISES.PDF","date":"2024-09-26"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-050a","date":"2025-02-19"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-255","name":null},{"id":"CWE-522","name":"Insufficiently Protected Credentials"}],"references":[{"url":"http://blogs.technet.com/b/srd/archive/2014/05/13/ms14-025-an-update-for-group-policy-preferences.aspx","tags":["Third Party Advisory"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-025","tags":["Patch","Vendor Advisory"]},{"url":"http://blogs.technet.com/b/srd/archive/2014/05/13/ms14-025-an-update-for-group-policy-preferences.aspx","tags":["Third Party Advisory"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-025","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-1812","tags":["US Government Resource"]}],"techniques":[{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1552.001","name":"Credentials In Files","tactics":["credential-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Attacker uses valid domain account access","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"remote authenticated users to obtain sensitive credential information","start":240,"end":309}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1552.006","name":"Group Policy Preferences","tactics":["credential-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Group Policy passwords exposed in SYSVOL","mappingType":"primary_impact","evidence":[{"from":"description","quote":"does not properly handle distribution of passwords","start":175,"end":225}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-9feeed74b9ff849baaad","title":"Detecting and mitigating Active Directory compromises","publisher":"cyber.gov.au","url":"https://www.cyber.gov.au/business-government/detecting-responding-to-threats/detecting-and-mitigating-active-directory-compromises?s=03","date":null,"mentions":[{"quote":"In 2014, a privilege escalation vulnerability (CVE-2014-1812) was discovered in Microsoft’s GPP.","start":41000,"end":41096}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2014-1886","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-1886","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2023-05-22","earliestUrl":"https://github.com/mauricelambert/gpp-encrypt","repos":[{"name":"mauricelambert/gpp-encrypt","url":"https://github.com/mauricelambert/gpp-encrypt","stars":0,"created":"2023-05-22"}]},"metasploit":[{"name":"SMB Group Policy Preference Saved Passwords Enumeration","module":"auxiliary/scanner/smb/smb_enum_gpp","type":"auxiliary","disclosureDate":null,"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/smb/smb_enum_gpp.rb"}],"first":{"date":"2023-05-22","source":"PoC-in-GitHub","url":"https://github.com/mauricelambert/gpp-encrypt"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"ai"},{"stage":"primary","techniques":["T1552.006"],"provenance":"ai"},{"stage":"related","techniques":["T1003","T1552.001"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2014-05-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2014/ms14-025","provenance":"source"},{"date":"2014-05-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1812","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-1886","provenance":"source"},{"date":"2023-05-22","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/mauricelambert/gpp-encrypt","provenance":"source"}],"speed":{"daysToPublicExploit":3295,"firstExploitFrom":"PoC-in-GitHub","daysToKev":2730},"priority":{"score":82.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4552 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.85,"detail":"percentile 0.9925"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}