Actively exploited in the wild
Microsoft Win32k Privilege Escalation Vulnerability
Microsoft - Win32k · Listed in the CISA KEV since 2022-05-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2015-2360
HighCVSS 8.8KEVSummary
Podatność w win32k.sys w sterownikach trybu jądra systemu Microsoft Windows umożliwia lokalnym użytkownikom uzyskanie podwyższonych uprawnień lub spowodowanie odmowy usługi poprzez złośliwą aplikację. Dotyczy to wielu wersji systemów Windows, w tym Windows Server 2003, Windows Vista, Windows 7, Windows 8 oraz Windows 10.
Risk Assessment
Organizacje mogą być narażone na nieautoryzowany dostęp do systemów oraz na awarie spowodowane uszkodzeniem pamięci, co może prowadzić do utraty danych lub przerwy w działaniu usług.
Recommendation
Zaleca się aktualizację systemów do najnowszych wersji oraz zastosowanie poprawek bezpieczeństwa, aby zminimalizować ryzyko związane z tą podatnością.
Related vulnerabilities
- CVE-2026-87886HighActively exploited
The vulnerability is a local privilege escalation due to insecure file permissions. It affects Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, and Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
- CVE-2026-87701Critical
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
- CVE-2026-85889Critical
Missing authentication for a critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-85885Critical
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
- CVE-2026-83944Critical
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-77903Critical
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70200Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70009Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69865Critical
Authorization bypass through a user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69399Critical
Elevation of Privilege vulnerability in Azure Arc. Technical details were not provided in the description.
Original NVD description (English source)
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."