CVE-2017-8699
HighSummary
Windows Shell in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to run arbitrary code in the context of the current user due to improper validation of file copy destinations.
Risk Assessment
This vulnerability could allow an attacker to gain control over the system, posing a significant threat to the security of the organization's data and infrastructure.
Recommendation
It is recommended to update systems to the latest versions and apply the relevant security patches provided by Microsoft.
Other vulnerabilities in Windows Shell
See all- CVE-2017-8463High
Windows Shell in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 has a remote code execution vulnerability due to improper handling of executable files and shares during rename operations.
- CVE-2016-0179High
Windows Shell in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted web site.
- CVE-2015-2515High
A use-after-free vulnerability in Windows Shell in various versions of Microsoft Windows allows remote attackers to execute arbitrary code via a crafted toolbar object.
- CVE-2026-32202MediumActively exploited
A protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network. This could lead to impersonation of trusted entities.
- CVE-2026-62770High
Heap-based buffer overflow in Windows Shell allows an authorized attacker to elevate privileges locally.
- CVE-2026-42907Medium
A vulnerability in Windows Shell allows an authorized attacker to disclose sensitive information over a network. The flaw stems from unauthorized access to data.
- CVE-2026-42906Medium
Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information locally.
- CVE-2026-20847Medium
Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to perform spoofing over a network.
- CVE-2026-20834Medium
An absolute path traversal vulnerability in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack.
Original NVD description (English source)
Windows Shell in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to run arbitrary code in the context of the current user, due to the way that Windows Shell validates file copy destinations, aka "Windows Shell Remote Code Execution Vulnerability".