CVE-2018-8589

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.030 · 87 %ileEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV

Likely / severe?

3.02% (87th) EPSS

CVSS 7.2 · high

Is it mine?

18 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

added 2022-05-23remediate by 2022-06-13

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-27

Microsoft Win32k Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2.

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.07.2highAV:L/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 3.9 · impact 10

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 5.9

v3.17.8highAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 1.8 · impact 5.9

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-119USCWE-264US

affected products (18)

Products and version ranges known to be affected.

Microsoft Windows 7≤ 32-bit Systems Service Pack 1enisa_euvdEU
Microsoft Windows 7≤ x64-based Systems Service Pack 1enisa_euvdEU
Microsoft Windows Server 2008≤ 32-bit Systems Service Pack 2enisa_euvdEU
Microsoft Windows Server 2008≤ x64-based Systems Service Pack 2 (Server Core installation)enisa_euvdEU
Microsoft Windows Server 2008≤ 32-bit Systems Service Pack 2 (Server Core installation)enisa_euvdEU
Microsoft Windows Server 2008≤ x64-based Systems Service Pack 2enisa_euvdEU
Microsoft Windows Server 2008≤ Itanium-Based Systems Service Pack 2enisa_euvdEU
Microsoft Windows Server 2008 R2≤ Itanium-Based Systems Service Pack 1enisa_euvdEU
Microsoft Windows Server 2008 R2≤ x64-based Systems Service Pack 1 (Server Core installation)enisa_euvdEU
Microsoft Windows Server 2008 R2≤ x64-based Systems Service Pack 1enisa_euvdEU
Microsoft Corp Windows 7 Service Pack 1all versionsfstec_bduRU
Microsoft Corp Windows Server 2008 R2 Service Pack 1all versionsfstec_bduRU
Microsoft Corp Windows Server 2008 R2 Service Pack 1 (Server Core installation)all versionsfstec_bduRU
Microsoft Corp Windows Server 2008 Service Pack 2all versionsfstec_bduRU
Microsoft Corp Windows Server 2008 Service Pack 2 (Server Core Installation)all versionsfstec_bduRU
microsoft windows 7all versionsnvdUScpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*
microsoft windows server 2008all versionsnvdUScpe:2.3:o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*
microsoft windows server 2008= r2nvdUScpe:2.3:o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2018-11-14modified 2026-06-17

references (11)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan