CVE-2016-0099 is a secondary logon service privilege escalation vulnerability in Microsoft Windows. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 March 2022, which means attackers have used it in real attacks. A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory.
What this vulnerability means in practice
A Windows Secondary Logon Service privilege escalation flaw matters because it can let a lower-privileged user cross a trust boundary inside the operating system. The danger is not just local elevation, but the ability to convert ordinary interactive access into a foothold with broader control over the host.
For a CVE like this, the key security question is what an attacker can do once they are already on the machine. Privilege escalation often turns a limited compromise into a platform for credential theft, persistence, software tampering, and follow-on lateral movement.
Why privilege escalation is dangerous on Windows
Privilege escalation flaws are especially serious in Windows because many defensive controls, management tools, and security boundaries assume that administrative access is meaningfully harder to obtain than standard user access. When that assumption fails, the attacker may be able to disable protection, inspect sensitive data, or modify local security settings.
This class of issue is dangerous even when it starts as a local-only weakness. Once an attacker gains elevated privileges, they can often target cached credentials, tokens, scheduled tasks, services, and security tooling that were previously out of reach.
How organisations should assess exposure
Exposure review starts with confirming whether any Windows systems in scope could still be affected, then mapping those systems to business-critical users, endpoints, and administrative workstations. Because this is a publicly known and exploited CVE, internet exposure and endpoint inventory both matter when prioritising review.
Authoritative version and remediation details should come from the vendor advisory and the CVE Program record, while exploitation prioritisation should be checked against the NIST National Vulnerability Database and the CISA KEV catalogue referenced in the primary definition. For broader prioritisation discipline, the Vulnerability Management Guide explains how KEV status fits into scanning, verification, and remediation workflows.
Remediation, detection, and post-incident review
The first remediation priority is to remove the vulnerable condition using the vendor’s fix path. Where patching cannot happen immediately, organisations should reduce the blast radius by tightening local privilege, limiting which users can reach the affected host, and increasing monitoring for suspicious service activity.
Detection should focus on signs that a normal user process has been followed by elevated execution, service abuse, or unexpected administrative changes. The MITRE ATT&CK Enterprise Matrix is useful for mapping likely privilege-escalation behaviour and related follow-on techniques. After patching, review whether the system was already compromised before the fix, because privilege escalation often appears late in the attack chain rather than as the initial entry point.
Risk and Threat Considerations
This kind of flaw is materially risky because it can turn a low-privilege foothold into elevated control of a Windows system. That creates a practical path to persistence, security-tool tampering, and lateral movement if the host is connected to wider enterprise services.
Failure mechanism: The Windows Secondary Logon Service fails to manage request handles correctly, allowing a local attacker to abuse the resulting memory-safety weakness and obtain higher privileges than intended.
Impact: Successful exploitation can expose sensitive local data, enable system-level changes, and give the attacker a stronger launch point for broader compromise across the environment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | CVE exploitation creates a flaw-remediation duty for affected Windows systems. |
| AC-6 — Least Privilege | Privilege escalation directly undermines least-privilege access enforcement. | |
| AU-6 — Audit Review, Analysis, and Reporting | Post-exploitation review depends on logging and analysis of suspicious elevation activity. | |
| Recommendation — Prioritise remediation of the vulnerable Windows service and verify fix deployment. Reduce local privilege and limit who can reach the affected Windows host. Review logs for abnormal elevation, service abuse, and follow-on administrative actions. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | A KEV-listed Windows CVE fits continuous vulnerability identification and prioritisation. |
| CIS-5 — Account Management | Privilege escalation changes the practical security of local accounts and admin use. | |
| Recommendation — Track exposure to the CVE and accelerate remediation for in-scope Windows assets. Restrict privileged accounts and review local admin paths on affected systems. | ||
Practitioner Guidance
Why practitioners should care: A KEV-listed local privilege escalation issue deserves faster handling than a routine vulnerability because real attackers have already used it. Treat affected Windows hosts as higher-risk until exposure has been confirmed and the fix path is complete.
What to watch for: Look for unusual privilege elevation, unexpected service behaviour, and post-exploitation activity that appears shortly after ordinary user access. If the host supports administrative workflows or sensitive tooling, assume the potential business impact is higher than on a standard workstation.
Practitioner takeaway: The right response is not only to patch, but also to verify whether the host was abused before patching and whether any credentials, sessions, or administrative actions need review after compromise.
Related resources from NHI Mgmt Group
- CVE-2023-28229 (Microsoft Windows CNG Key Isolation Service Privilege Escalation)
- CVE-2023-36874 (Microsoft Windows Error Reporting Service Privilege Escalation)
- CVE-2022-41125 (Microsoft Windows CNG Key Isolation Service Privilege Escalation)
- CVE-2022-41033 (Microsoft Windows COM+ Event System Service Privilege Escalation)