CVE-2010-2568 KEVPublic exploit High · 7.8 EPSS 89.6%

Microsoft Windows Remote Code Execution Vulnerability

Summary

The flaw is an improper input validation issue in the Windows Shell component of Microsoft Windows, affecting XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7, where crafted .LNK or .PIF shortcut files are not handled correctly during icon display in Windows Explorer.

Official description · NVD

Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.

Breakdown

77.4 / 100

Exploited: Yes, in CISA KEV
Reports: 4
Tactics: 1/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Trick a user into clicking a linkT1204.001 · Malicious LinkAI-written (claude-haiku-5-5)Medium confidence4 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterAI-written (claude-haiku-5-5)Medium confidence95 general detection rules

First seen exploited 2 months after disclosure. Public exploit code (Metasploit) was available 6 days before disclosure.

Public exploit codeMetasploit16 Jul 20106 days before
Disclosed22 Jul 2010day 0
First seen exploitedVulnCheck KEV evidence1 Oct 2010+2 mo
Added to CISA KEVEU database agrees15 Sep 2022+12 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

AI mapping from the description · primary impact

arbitrary code execution from shortcut

allows local users or remote attackers to execute arbitrary code

From the official description (NVD) Original ↗

Malicious Link T1204.001 Medium

AI mapping from the description · how it is exploited

user opens malicious shortcut file

via a crafted (1) .LNK or (2) .PIF shortcut file

From the official description (NVD) Original ↗

Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

Exploitation for Client ExecutionT1203 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)

Detection

0 rules for this CVE · 99 general rules for its techniques

Rules for this CVE

0 that reference CVE-2010-2568 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Malicious LinkT1204.0014 general rules

Symlink Etc Passwdhightest
Potential ClickFix Execution Pattern - Registryhighexperimental
Suspicious ClickFix/FileFix Execution Patternhighexperimental
Suspicious Execution via macOS Script Editormediumtest

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 4 threat reports

4 reportsMicrosoft2media.kasperskycontenthub.comdocs.broadcom.com

Reports are matched by finding the exact id CVE-2010-2568 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

MicrosoftUndated

Microsoft Security

…detected and blocked by Microsoft real-time antimalware products in 1H16, shaded according to relative prevalence Exploit Type 3Q15 4Q15 1Q16 2Q16 JS/Axpergle Exploit kit 0.71% 0.92% 0.53% 0.40% SWF/Netis Adobe Flash Player 0.00% 0.00% 0.27% 0.00% CVE-2010-2568 (CplLnk) Operating system 0.18% 0.24% 0.13%…

5 passages name itOriginal (opens in a new tab) ↗

MicrosoftUndated

Microsoft Security

An attacker exploits CVE-2010-2568 by creating a malformed shortcut file—typically distributed through…

5 passages name itOriginal (opens in a new tab) ↗

media.kasperskycontenthub.comUndated

Version: 1.5

Mentions the CVE; no further detail.

Original (opens in a new tab) ↗

docs.broadcom.comUndated

Security Response

Mentions the CVE; no further detail.

Original (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

15 links, grouped by NVD tag (14 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 15 Sep 2022. Federal due date 6 Oct 2022. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 15 Sep 2022. EUVD-2010-2572

Microsoft Windows - Automatic .LNK Shortcut File Code ExecutionEDB-14403 · local · windows · 2010-07-18 · verified
Microsoft Windows - Shell LNK Code Execution (MS10-046) (Metasploit)EDB-16574 · remote · windows · 2010-09-21 · verified

, 30 Oct 2026

89.6%Top 0.21%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.79%).

3.1

7.8High · 7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 5874 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9979 20.0/20

Threat reports4 reports 9.0/10

Public exploit code3 NVD references tagged Exploit; 2 Exploit-DB entries; 3 Metasploit modules 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 7.8 5.5/7

End-of-life productsupported or unknown 0.0

Total77.4

Record

Published: 22 Jul 2010
Modified: 16 Jun 2026
: CWE-20 Improper Input Validation
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

What security researchers reported

Microsoft Security

Microsoft Security

Version: 1.5

Security Response

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 3

Patch 1

US Government Resource 2

Third Party Advisory 3

Exploit 2

Issue Tracking 1

Press/Media Coverage 1

Not Applicable 1

Broken Link 1

How attackers get in

What they do

techniques