CVE-2018-0886

highpriority · attend · 67EPSS 0.820 · 100 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

2 exploits · PoC

Likely / severe?

82.0% (100th) EPSS

CVSS 7.6 · high

Is it mine?

39 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709 Windows Server 2016 and Windows Server, version 1709 allows a remote code execution vulnerability due to how CredSSP validates request during the authentication process, aka "CredSSP Remote Code Execution Vulnerability".

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

Mitigationpepperl_fuchs_psirt
Customers using Pepperl+Fuchs HMI devices out of VisuNet RM*, VisuNet PC* or Box Thin Client BTC* product families should follow these guidelines: - Pepperl+Fuchs HMI devices running RM Shell 4 should be updated with RM Image 4 Security Patches 01/2017 to 05/2018 (18-33400C): https://www.pepperl-fuchs.com/cgi-bin/db/doci.pl/?ShowDocByDocNo=18-33400c - Pepperl+Fuchs HMI devices running RM Shell 5 should be updated with RM Image 5 Security: Windows Cumulative Security Patch 07/2018 (18-33624): https://www.pepperl-fuchs.com/cgi-bin/db/doci.pl/?ShowDocByDocNo=18-33624 - Pepperl+Fuchs HMI devices running Windows 7 or Windows 10 should be updated by using the Windows Update mechanism. - After deploying the patch all connected third-party clients or servers must use the latest version of the CredSSP protocol. Be aware of installing these patches, because security will be enforced by the update. Security by default restriction might result in an error due to encryption oracle remediation. Updates should be installed on both the server and the HMI device; otherwise, system compatibility might be influenced. This advisory will be updated as further details and/or software updates become available.
MitigationBox Thin Client BTCcisa_csaf_ot
After deploying the patch, all connected third-party clients or servers must use the latest version of the CredSSP protocol.
MitigationVisuNet PCcisa_csaf_ot
After deploying the patch, all connected third-party clients or servers must use the latest version of the CredSSP protocol.
MitigationVisuNet RMcisa_csaf_ot
After deploying the patch, all connected third-party clients or servers must use the latest version of the CredSSP protocol.

cvss

Technical severity, 0–10. One row per scoring source.

7.6

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.07.6highAV:N/AC:H/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 4.9 · impact 10

v3.07highCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1 · impact 5.9

v3.07.5highCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.07highCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · Pepperl+Fuchs PSIRT DE

v3.07highCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.17highAV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-287USprimaryCWE-287USCWE-287USCWE-287US

exploits (2)

Public proof-of-concept and weaponised exploit code.

EDB-44453Microsoft Credential Security Support Provider - Remote Code ExecutionPoC · exploit_db
preempt/credsspA code demonstrating CVE-2018-0886PoC · poc_in_github

affected products (39)

Products and version ranges known to be affected.

Box Thin Client BTC: All modelsall versionscisa_csaf_otUS
VisuNet PC: All modelsall versionscisa_csaf_otUS
VisuNet RM: All modelsall versionscisa_csaf_otUS
PEPPERL+FUCHS Box Thin Client BTCall versionscisa_csaf_otUS
PEPPERL+FUCHS VisuNet PCall versionscisa_csaf_otUS
PEPPERL+FUCHS VisuNet RMall versionscisa_csaf_otUS
Microsoft Corporation Windows≤ Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709 Windows Server 2016 and Windows Server, version 1709enisa_euvdEU
Microsoft Corp Windows 10all versionsfstec_bduRU
Microsoft Corp Windows 10 1511all versionsfstec_bduRU
Microsoft Corp Windows 10 1607all versionsfstec_bduRU
Microsoft Corp Windows 10 1703all versionsfstec_bduRU
Microsoft Corp Windows 10 1709all versionsfstec_bduRU
Microsoft Corp Windows 7 Service Pack 1all versionsfstec_bduRU
Microsoft Corp Windows 8.1all versionsfstec_bduRU
Microsoft Corp Windows RT 8.1all versionsfstec_bduRU
Microsoft Corp Windows Server 2008 R2 Service Pack 1all versionsfstec_bduRU
Microsoft Corp Windows Server 2008 Service Pack 2all versionsfstec_bduRU
Microsoft Corp Windows Server 2012all versionsfstec_bduRU
Microsoft Corp Windows Server 2012 R2all versionsfstec_bduRU
Microsoft Corp Windows Server 2016all versionsfstec_bduRU

showing 20 of 39

advisories (2)

Vendor and ecosystem advisories describing this.

VDE-2018-008Pepperl+Fuchs: Remote Code Execution Vulnerability in HMI Devices2018-07-06csaf · pepperl_fuchs_psirtDE
A remote code execution vulnerability in the Microsoft's Credential Security Support Provider protocol (CredSSP) was identified by security researchers. If exploited successfully, it is possible to relay user credentials for arbitrary code execution on the target system. See details on Microsoft Advisory CVE-2018-0866 (https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2018-0886)
ICSA-18-198-03PEPPERL+FUCHS VisuNet RM, VisuNet PC, and Box Thin Client2018-07-17icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow attackers to intercept sensitive communications, establish a man-in-the-middle attack, achieve administrator privileges, and execute remote code.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot pepperl_fuchs_psirt NVD CVE.org MITRE

published 2018-03-14modified 2026-06-17

related (7,710)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-105133US	high7.3OT critical	79.5% (100th)	KEV	2026-10-04
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component…
CVE-2026-82329US	—OT critical	14.4% (97th)	KEV	2026-08-28
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileg…
CVE-2026-42018US	—OT critical	9.80% (96th)	KEV	2026-08-12
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
CVE-2026-65400US	—OT critical	1.72% (77th)	KEV	2026-08-06
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, ma…
CVE-2026-16232US	critical9.8OT critical	3.52% (89th)	KEV	2026-07-22
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to au…

+7705 more

references (24)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan