Is CVE-2015-2387 (Microsoft ATM Font Driver Privilege Escalation) being exploited in the wild?

Yes. CISA added CVE-2015-2387 to its Known Exploited Vulnerabilities catalogue on 3 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application.

What “exploited in the wild” means for this CVE

For a vulnerability question like this, “in the wild” matters more than the label on the CVE record. Once CISA places a CVE in KEV, the practical assumption is that real exploitation has already been observed, so the issue shifts from theoretical risk to active exposure management. For a local privilege escalation flaw in Windows, that means treating any reachable system as a potential escalation foothold.

The key practitioner question is not whether exploitation is possible, but whether the vulnerable product is present anywhere in the estate and whether an attacker with low-level access could chain it into higher privilege. Microsoft Windows Server environments are especially sensitive here because a privilege escalation path can turn a minor initial compromise into full host control.

For a concise response path and triage framing, the Zero-Day and Exploited Vulnerabilities Guide is the right internal starting point for KEV-driven response decisions.

How to confirm exposure and assess blast radius

First confirm where ATMFD.DLL and the affected Windows build lineage exist, then identify which hosts have meaningful interactive logon exposure, local execution opportunity, or shared administrative paths. A local privilege escalation flaw is often most dangerous on endpoints and servers where low-privilege footholds already exist, because the exploit value is in turning a foothold into system-level control.

After that, assess whether those systems hold credentials, service tokens, admin sessions, or management tooling that would let an attacker expand beyond the original host. Privilege escalation is rarely the end state; it is usually the bridge to credential theft, persistence, lateral movement, and deeper operational access.

When you need a broader playbook for prioritising vulnerable systems, the Vulnerability Management Guide helps connect KEV status to prioritisation, exceptions, and verification.

What to do if patching or mitigation must wait

If immediate remediation is not possible, reduce the number of systems where untrusted code can run and narrow the opportunities for local execution. That usually means tightening administrative access, limiting interactive use on servers, and isolating high-value Windows hosts that do not need broad user execution paths. For this class of issue, compensating controls are about shrinking the set of accounts and endpoints that can convert a local bug into privilege gain.

Where escalation risk is material, review whether administrative privilege is already too broad and whether standing access makes the blast radius larger than necessary. If a host can be touched by ordinary users, contractors, or automation accounts, treat that exposure as part of the temporary risk picture until the flaw is remediated.

The Privileged Access Management Guide is the most relevant NHIMG reference for limiting standing privilege while you work through the remediation window.

Risk and Threat Considerations

This kind of flaw is dangerous because local privilege escalation turns any initial foothold into a much more powerful one. In practice, that can let an attacker move from a limited user context to system-level control, which is enough to disable defenses, steal additional secrets, or stage lateral movement.

Failure mechanism: A crafted local execution path triggers the font driver bug and elevates the attacker’s privileges on the host, bypassing the normal trust boundary between standard users and administrative code paths.

Impact: The compromised system can become a launch point for credential theft, persistence, defense evasion, and follow-on compromise of adjacent Windows assets, especially where the host already stores or can reach higher-value credentials.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	KEV exploitation requires prioritising active vulnerability risk across the estate.
	PR.AA-05 — Identity Management, Authentication, and Access Control	Privilege escalation changes access boundaries and host control.
Recommendation — Prioritise KEV-listed issues in the risk register and remediation queue. Restrict administrative access paths and remove unnecessary privilege.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes timely identification and remediation of vulnerable hosts essential.
Recommendation — Scan, prioritise, and remediate KEV-listed vulnerabilities on exposed systems.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE requires remediation of a known exploited flaw in Windows.
Recommendation — Patch or mitigate the vulnerable software promptly and verify closure.
MITRE ATT&CK	T1068 — Exploitation for Privilege Escalation	The CVE is a local privilege escalation technique directly matching this ATT&CK tactic.
Recommendation — Map telemetry for local exploit activity to privilege-escalation detections.

Practitioner Guidance

What to prioritise: Treat KEV-listed local privilege escalation issues as host-control problems, not just patch tickets. Prioritise systems where untrusted code, multiple users, or elevated operational access coexist, because those environments make exploitation materially more valuable to an attacker.

What to verify: Confirm whether remediation actually removed the vulnerable component or blocked the relevant attack path, then verify that no privileged sessions, service accounts, or cached credentials were exposed on the affected host. If compromise is suspected, check for persistence and abnormal admin activity before restoring trust in the machine.

Practitioner takeaway: For an exploited local privilege escalation CVE, the right question is not only “is it patched,” but “could this host have been used to seize higher privilege before we noticed?”