CVE-2002-0367 is a privilege escalation vulnerability in Microsoft Windows. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 March 2022, which means attackers have used it in real attacks. smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges.
What this vulnerability means in Windows
CVE-2002-0367 is a local privilege escalation flaw, so the danger is not initial access but what happens after a low-privilege user can interact with the affected Windows subsystem. In practice, this kind of bug turns a normal user session into a path to administrator or SYSTEM-level control.
The core security problem is broken trust inside the operating system boundary. When a subsystem fails to authenticate the caller properly, the operating system may grant actions that should have remained restricted, which can undermine the entire host even when the attacker starts with limited local access.
Why privilege escalation bugs are dangerous
Privilege escalation vulnerabilities matter because they let an attacker convert foothold into control. Once SYSTEM or administrator privileges are obtained, the attacker can disable security tooling, tamper with audit logs, install persistent services, change security settings, and access data that was previously protected by least-privilege boundaries.
That escalation also changes the blast radius of an incident. A compromise that began as a single local account issue can become full host compromise, and on a shared or management workstation that may expose credentials, administrative sessions, or other high-value assets sitting on the same machine.
For Windows environments, the practical concern is often what the attacker can do after escalation rather than the exploit itself. MITRE ATT&CK Enterprise Matrix is useful here because it maps privilege escalation to the techniques defenders use to understand post-compromise behaviour.
How organisations should check exposure
Exposure review starts with knowing where Windows systems are deployed, what versions are still in use, and which hosts can be reached by local users, remote support tools, or shared admin access. Because this CVE is in the CISA Known Exploited Vulnerabilities catalogue, organisations should treat confirmed inventory and remediation status as a priority rather than an abstract hardening item.
Checks should be tied to vendor guidance and authoritative vulnerability records, not memory or folklore. Use the NIST National Vulnerability Database and the CVE Program for the canonical record, then map those details to your asset inventory, endpoint management data, and remediation queue.
If you need a broader operational lens for prioritising known exploited issues, NHIMG’s Vulnerability Management Guide provides the asset-scope and prioritisation context that should surround KEV-listed vulnerabilities like this one.
Remediation and compensating controls
The preferred response is to remove the vulnerable condition by applying the vendor’s remediation path and verifying that the affected Windows hosts are no longer exposed to the flaw. Where patching is delayed, compensating controls should narrow who can log on locally, reduce administrative exposure, and limit the opportunity for a low-privilege user to reach the vulnerable code path.
Because local escalation flaws often become useful after an attacker already has a foothold, hardening should focus on containment as well as prevention. Restrict interactive access, remove unnecessary local accounts, reduce standing administrator access, and separate administrative work from general user activity.
NHIMG’s Privileged Access Management Guide is relevant because privilege escalation only becomes operationally damaging when excessive privilege, standing access, or weak session controls are present.
Detection and post-exploitation review
Detection should look for evidence that a low-privilege process has spawned or interacted with high-privilege activity, especially on endpoints where local users should never reach administrative boundaries. Review event logs, endpoint telemetry, and service creation data for signs that a normal user context was used to trigger privileged behaviour.
After patching, organisations should review whether the vulnerability was already used as an entry point. That means checking for new accounts, altered local groups, suspicious services, tampered security settings, disabled protections, and signs that the host was used to steal credentials or stage lateral movement.
If the system is part of a broader Windows administration estate, Sourcegraph breach 2023 is a useful reminder that a single privileged foothold can quickly become broader administrative abuse when high-value access material is present on the host.
Risk and Threat Considerations
This vulnerability is dangerous because it gives attackers a reliable way to turn limited local access into full host control. Once that happens, the attacker can disable defenses, steal secrets, and move from a single account compromise to systemwide impact.
Failure mechanism: The Windows debugging subsystem does not properly authenticate programs that connect to other programs, so a local user can trigger privileged behaviour that should have been blocked.
Impact: An attacker can gain administrator or SYSTEM privileges, which can enable persistence, credential theft, security tool tampering, and follow-on lateral movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0004 — Privilege Escalation | This CVE is a local privilege escalation vulnerability. |
| Recommendation — Map the exploit path to privilege escalation and hunt for follow-on administrative abuse. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Escalation incidents often require rotating or invalidating credentials after compromise. |
| AC-6 — Least Privilege | The flaw defeats least-privilege boundaries by elevating a local user to admin or SYSTEM. | |
| AU-6 — Audit Review, Analysis, and Reporting | Post-exploitation review depends on reviewing logs for privileged activity and persistence. | |
| Recommendation — Rotate exposed credentials and invalidate any authenticator material used on the affected host. Restrict local administrative rights and reduce standing privilege on Windows endpoints. Review endpoint and system logs for evidence of escalation, persistence, and tampering. | ||
| CIS Controls v8 | CIS-5 — Account Management | Local privilege escalation becomes more damaging when accounts and access are overexposed. |
| Recommendation — Limit local account exposure and remove unnecessary administrative access paths. | ||
Practitioner Guidance
Why practitioners should care: Treat KEV-listed local privilege escalation flaws as host-control issues, not just patch hygiene. If a low-privilege account can become SYSTEM, the endpoint should be considered a likely pivot point for deeper compromise.
What to watch for: Prioritise systems where local users, shared support access, or delegated admin workflows exist, because those environments give an attacker the easiest path to exploit a privilege boundary weakness.
Practitioner takeaway: Patch first, then validate that the host cannot be escalated from a standard user context and that no post-exploitation persistence remains.
Related resources from NHI Mgmt Group
- CVE-2014-1812 (Microsoft Windows Group Policy Preferences Password Privilege Escalation)
- CVE-2019-1388 (Microsoft Windows Certificate Dialog Privilege Escalation)
- CVE-2024-38107 (Microsoft Windows Power Dependency Coordinator Privilege Escalation)
- CVE-2021-43226 (Microsoft Windows Privilege Escalation)