Security Resilience

CVE-2018-8440

Microsoft Windows Server 2008 r2

CISA KEVActive ExploitationEUVD ExploitedPublic PoCRansomware-linked
Published
13 September 2018
Modified
28 October 2025
KEV Added
28 March 2022
Patch / advisory
View advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.18 97th percentile
Risk Priority 83 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2018-8440 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).

Operationally, ranked in the top 3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

An elevation of privilege vulnerability exists in Windows when the operating system improperly handles calls to Advanced Local Procedure Call (ALPC). Tracked as CVE-2018-8440, the flaw affects Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows 10, and Windows 10 Servers.

A local attacker with low privileges can exploit the issue without user interaction to obtain elevated rights on the target system, resulting in high impact to confidentiality, integrity, and availability.

Microsoft has published security guidance addressing the vulnerability through its advisory portal, while micropatch approaches have also been developed and compared for environments where standard updates may require additional measures.

EU & UK References

Vulnerability Data

An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server…

more

2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

CWE(s)
NVD-CWE-noinfo
KEV Date Added
28 March 2022

Related Threats

CVEs Like This One

CVE-2018-8174Same product: Microsoft Windows 10 1607both on KEV
CVE-2018-8611Same product: Microsoft Windows 10 1607both on KEV
CVE-2018-8373Same product: Microsoft Windows 10 1607both on KEV
CVE-2018-8639Same product: Microsoft Windows 10 1607both on KEV
CVE-2019-1315Same product: Microsoft Windows 10 1607both on KEV
CVE-2018-0824Same product: Microsoft Windows 10 1607both on KEV
CVE-2017-8464Same product: Microsoft Windows 10 1607both on KEV
CVE-2019-0676Same product: Microsoft Windows 10 1607both on KEV
CVE-2018-8653Same product: Microsoft Windows 10 1607both on KEV
CVE-2019-1367Same product: Microsoft Windows 10 1607both on KEV

Affected Assets

microsoft
windows 10 1607
all versions
microsoft
windows 10 1703
all versions
microsoft
windows 10 1709
all versions
microsoft
windows 10 1803
all versions
microsoft
windows 7
all versions
microsoft
windows 8.1
all versions
microsoft
windows rt 8.1
all versions
microsoft
windows server 2008
all versions, r2
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
all versions

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References