{"id":"CVE-2017-0213","published":"2017-05-12T14:29:01Z","modified":"2026-06-17T00:57:16Z","title":"Microsoft Windows Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka \"Windows COM Elevation of Privilege Vulnerability\". This CVE ID is unique from CVE-2017-0214.","provenance":"source","from":"NVD"},"summary":{"text":"The Windows COM Aggregate Marshaler component in Microsoft Windows (including Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8.1, Windows 10 and Windows Server 2012 and 2016) contains a privilege escalation flaw that allows an elevation of privilege. An attacker who already has local access and low-privilege authentication can exploit it by running a specially crafted application, which requires user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:54:26Z"},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.84258,"percentile":0.99695,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-28","dueDate":"2022-04-18","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0213","provenance":"source"},"vulncheckKev":{"dateAdded":"2018-12-21","exploitedFirstSeen":"2018-12-21","ransomware":true,"evidence":[{"url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html","date":"2018-12-21"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/v1-4-r_index-update-q121-csw-compressed.pdf","date":"2020-03-31"},{"url":"https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/","date":"2020-05-27"},{"url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-defenders-blog-netwalker/","date":"2020-08-03"},{"url":"https://www.hhs.gov/sites/default/files/netwalker.pdf","date":"2020-09-24"},{"url":"https://www.tenable.com/blog/daisy-chaining-how-vulnerabilities-can-be-greater-than-the-sum-of-their-parts","date":"2021-01-21"},{"url":"https://cybersecurityworks.com/pdf/ransomware/Spotlight_Ransomware2021.pdf","date":"2021-02-11"},{"url":"https://www.ic3.gov/Media/News/2022/220126.pdf","date":"2022-01-26"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-28"},{"url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-a-look-into-the-group-s-unconventional-techniques-new-attack-vectors-and-tools/","date":"2023-07-18"}],"evidenceTotal":14,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/98102","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038457","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0213","tags":["Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/42020/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/98102","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038457","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0213","tags":["Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/42020/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0213","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping","report-attack-id"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: local privilege escalation via crafted application; ATT&CK ID T1068 written in the same sentence as CVE-2017-0213","mappingType":"uncategorized","evidence":[{"from":"description","quote":"allows an elevation privilege vulnerability when an attacker runs a specially crafted application","start":221,"end":318},{"reportId":"SRC-6b3e642533244fecdf80","quote":"Exploitation for Privilege Escalation (T1068): CVE-2020-0796, CVE-2019-1458, CVE-2017-0213, CVE-2015-1701","start":26302,"end":26407},{"reportId":"SRC-b072c61974965d9184f6","quote":"Exploitation for Privilege Exploitation ((T1068) CVE-2017-0213","start":10112,"end":10174}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1211","name":"Exploitation for Stealth","tactics":["stealth"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: elevates privileges beyond intended level","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows an elevation privilege vulnerability when an attacker runs a specially crafted application","start":221,"end":318}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-b072c61974965d9184f6","title":"McAfee Defender’s Blog: NetWalker","publisher":"mcafee.com","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-defenders-blog-netwalker/","date":null,"mentions":[{"quote":"Exploitation for Privilege Exploitation ((T1068) CVE-2017-0213","start":10112,"end":10174},{"quote":"Network Security Platform (CVE-2017-0213); Endpoint Security Platform 10.7 (CVE-2017-0213) Threat Prevention, Application Control (MAC)","start":10281,"end":10416}]},{"id":"SRC-7f80eadb83bfff15d2c9","title":"OVERRULED: Containing a Potentially Destructive Adversary","publisher":"cloud.google.com","url":"https://cloud.google.com/blog/topics/threat-intelligence/overruled-containing-a-potentially-destructive-adversary","date":null,"mentions":[{"quote":"The actor leveraged a publicly available exploit for CVE-2017-0213 to escalate privileges, publicly available Windows SysInternals PROCDUMP to dump the LSASS process, and publicly available MIMIKATZ to presumably steal additional credentials.","start":4705,"end":4947}]},{"id":"SRC-6b3e642533244fecdf80","title":"Take a “NetWalk” on the Wild Side","publisher":"mcafee.com","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/take-a-netwalk-on-the-wild-side/","date":null,"mentions":[{"quote":"Exploitation for Privilege Escalation (T1068): CVE-2020-0796, CVE-2019-1458, CVE-2017-0213, CVE-2015-1701","start":26302,"end":26407}]},{"id":"SRC-29343aece4ae7e94552e","title":"Uncovering DRBControl: Inside the Cyberespionage Campaign Targeting Gambling Operations","publisher":"documents.trendmicro.com","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf","date":null,"mentions":[{"quote":"a clipboard\r\nstealer, wherein the content is encrypted with the same algorithm as the type 1 backdoor; a network traffic\r\ntunnel named EarthWorm;13 a public IP address retriever; 14 an NBTScan tool for enumerating NetBIOS\r\nshares; a brute-force tool; 15 and an elevation of privilege tool for exploiting CVE-2017-0213.","start":28474,"end":28792},{"quote":"“CVE-2017-0213.cpp.”","start":60611,"end":60631},{"quote":"windows-kernel-exploits/blob/master/CVE-2017-0213/CVE-2017-0213.cpp.","start":60697,"end":60765}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-0579","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-0579","exploited":true,"exploitedSince":"2022-03-28","provenance":"source"},"exploits":[{"id":42020,"url":"https://www.exploit-db.com/exploits/42020","title":"Microsoft Windows - COM Aggregate Marshaler/IRemUnknown2 Type Confusion Privilege Escalation","type":"local","platform":"windows","date":"2017-05-17","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2017-05-17"},"pocGithub":{"count":4,"skipped":2,"earliest":"2017-07-01","earliestUrl":"https://github.com/zcgonvh/CVE-2017-0213","repos":[{"name":"zcgonvh/CVE-2017-0213","url":"https://github.com/zcgonvh/CVE-2017-0213","stars":57,"created":"2017-07-01"},{"name":"eonrickity/CVE-2017-0213","url":"https://github.com/eonrickity/CVE-2017-0213","stars":13,"created":"2018-04-10"},{"name":"jbooz1/CVE-2017-0213","url":"https://github.com/jbooz1/CVE-2017-0213","stars":1,"created":"2018-03-21"},{"name":"Anonymous-Family/CVE-2017-0213","url":"https://github.com/Anonymous-Family/CVE-2017-0213","stars":0,"created":"2022-01-29"}]},"first":{"date":"2017-05-17","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/42020"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/42020/"],"flow":[{"stage":"primary","techniques":["T1548"],"provenance":"ai"},{"stage":"related","techniques":["T1068"],"provenance":"source"},{"stage":"related","techniques":["T1211"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2017-05-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0213","provenance":"source"},{"date":"2017-05-17","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-42020); later: PoC-in-GitHub 2017-07-01","url":"https://www.exploit-db.com/exploits/42020","provenance":"source"},{"date":"2018-12-21","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html","provenance":"source"},{"date":"2022-03-28","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-28","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-0579","provenance":"source"}],"speed":{"daysToPublicExploit":5,"firstExploitFrom":"Exploit-DB","daysToKev":1781},"priority":{"score":87.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2869 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9970"},{"name":"Named in threat reports","points":8.98,"detail":"4 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 4 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.11,"detail":"base score 7.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}