CVE-2018-0883

highpriority · track · 35EPSS 0.145 · 97 %ileEURUUS

grimoire priorityP1 · Urgent

Exploitable?

—

no known exploitation

Likely / severe?

14.5% (97th) EPSS

CVSS 7.6 · high

Is it mine?

32 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-28

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, Windows Server 2016 and Windows Server, version 1709 allows a remote code execution vulnerability due to how file copy destinations are validated, aka "Windows Shell Remote Code Execution Vulnerability".

cvss

Technical severity, 0–10. One row per scoring source.

7.6

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.6

v2.07.6highAV:N/AC:H/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 4.9 · impact 10

v3.07.5highCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.6 · impact 5.9

v3.06.9mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284US

affected products (32)

Products and version ranges known to be affected.

Microsoft Corporation Windows Shell≤ Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, Windows Server 2016 and Windows Server, version 1709enisa_euvdEU
Microsoft Corp Windows 10all versionsfstec_bduRU
Microsoft Corp Windows 10 1511all versionsfstec_bduRU
Microsoft Corp Windows 10 1607all versionsfstec_bduRU
Microsoft Corp Windows 10 1703all versionsfstec_bduRU
Microsoft Corp Windows 10 1709all versionsfstec_bduRU
Microsoft Corp Windows 7 Service Pack 1all versionsfstec_bduRU
Microsoft Corp Windows 8.1all versionsfstec_bduRU
Microsoft Corp Windows RT 8.1all versionsfstec_bduRU
Microsoft Corp Windows Server 1709 (Server Core Installation)all versionsfstec_bduRU
Microsoft Corp Windows Server 2008 R2 Service Pack 1all versionsfstec_bduRU
Microsoft Corp Windows Server 2008 R2 Service Pack 1 (Server Core installation)all versionsfstec_bduRU
Microsoft Corp Windows Server 2008 Service Pack 2all versionsfstec_bduRU
Microsoft Corp Windows Server 2012all versionsfstec_bduRU
Microsoft Corp Windows Server 2012 (Server Core installation)all versionsfstec_bduRU
Microsoft Corp Windows Server 2012 R2all versionsfstec_bduRU
Microsoft Corp Windows Server 2012 R2 (Server Core installation)all versionsfstec_bduRU
Microsoft Corp Windows Server 2016all versionsfstec_bduRU
Microsoft Corp Windows Server 2016 (Server Core installation)all versionsfstec_bduRU
microsoft windows 10all versionsnvdUScpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*

showing 20 of 32

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2018-03-14modified 2026-06-17

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan