{"id":"CVE-2015-1769","published":"2015-08-15T00:59:01Z","modified":"2026-06-17T00:22:57Z","title":"Microsoft Windows Mount Manager Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 mishandles symlinks, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka \"Mount Manager Elevation of Privilege Vulnerability.\"","provenance":"source","from":"NVD"},"summary":{"text":"The Windows Mount Manager component, present in Microsoft Windows Vista SP2 through Windows 10 including Server 2008 and 2012 editions, mishandles symbolic links. An attacker with physical proximity to the machine can execute arbitrary code by connecting a crafted USB device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:11Z"},"cvss":{"score":6.6,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.04078,"percentile":0.90662,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-05-25","dueDate":"2022-06-15","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-1769","provenance":"source"},"vulncheckKev":{"dateAdded":"2015-08-11","exploitedFirstSeen":"2015-08-11","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2015-08-11"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-05-25"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-264","name":null}],"references":[{"url":"http://blogs.technet.com/b/srd/archive/2015/08/11/defending-against-cve-2015-1769-a-logical-issue-exploited-via-a-malicious-usb-stick.aspx","tags":["Vendor Advisory"]},{"url":"http://www.securitytracker.com/id/1033244","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-085","tags":["Patch","Vendor Advisory"]},{"url":"http://blogs.technet.com/b/srd/archive/2015/08/11/defending-against-cve-2015-1769-a-logical-issue-exploited-via-a-malicious-usb-stick.aspx","tags":["Vendor Advisory"]},{"url":"http://www.securitytracker.com/id/1033244","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-085","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1769","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Symlink mishandling yields privilege escalation and code execution","mappingType":"uncategorized","evidence":[{"from":"description","quote":"mishandles symlinks, which allows physically proximate attackers to execute arbitrary code","start":194,"end":284}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1091","name":"Replication Through Removable Media","tactics":["initial-access","lateral-movement"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1200","name":"Hardware Additions","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Physical USB device connection is the entry vector","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"physically proximate attackers to execute arbitrary code by connecting a crafted USB device","start":228,"end":319}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":"CVE-2015-1769 USB vector Microsoft Windows MS15-085","start":98659,"end":98710},{"quote":"54\r\nCVE-2014-0497, 53\r\nCVE-2014-0515, 53\r\nCVE-2014-6332, 43, 44, 50\r\nCVE-2014-8439, 46, 53\r\nCVE-2015-0097, 57\r\nCVE-2015-0310, 47\r\nCVE-2015-0311, 46, 47, 53\r\nCVE-2015-0313, 46, 47, 53\r\nCVE-2015-0336, 47, 53\r\nCVE-2015-0359, 47, 53\r\nCVE-2015-1641, 16, 57\r\nCVE-2015-1701, 14, 18, 19, 57\r\nCVE-2015-1769,","start":238286,"end":238584}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2015-1899","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-1899","exploited":true,"exploitedSince":"2022-05-25","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2021-02-17","earliestUrl":"https://github.com/int0/CVE-2015-1769","repos":[{"name":"int0/CVE-2015-1769","url":"https://github.com/int0/CVE-2015-1769","stars":1,"created":"2021-02-17"}]},"first":{"date":"2021-02-17","source":"PoC-in-GitHub","url":"https://github.com/int0/CVE-2015-1769"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1200"],"provenance":"ai"},{"stage":"related","techniques":["T1068"],"provenance":"source"},{"stage":"related","techniques":["T1091"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2015-08-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2015-08-15","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1769","provenance":"source"},{"date":"2021-02-17","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/int0/CVE-2015-1769","provenance":"source"},{"date":"2022-05-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-05-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-1899","provenance":"source"}],"speed":{"daysToPublicExploit":2013,"firstExploitFrom":"PoC-in-GitHub","daysToKev":2475},"priority":{"score":69.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4097 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.13,"detail":"percentile 0.9066"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.62,"detail":"base score 6.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-264"}}