Is CVE-2013-5065 (Microsoft Windows Kernel Privilege Escalation) being exploited in the wild?

Yes. CISA added CVE-2013-5065 to its Known Exploited Vulnerabilities catalogue on 3 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges.

What it means when a CVE is in CISA KEV

CISA’s Known Exploited Vulnerabilities catalogue is not a theoretical list. If a CVE appears there, defenders should treat it as evidence that exploitation has already happened or is happening in the wild, so the question shifts from “is this exploitable?” to “are we exposed, and have we already been touched?”

For CISA Known Exploited Vulnerabilities Catalog items, the practical task is to identify whether the vulnerable product is present, whether the vulnerable component is reachable, and whether compensating controls can buy time if patching cannot happen immediately.

Because this CVE affects Microsoft Windows Kernel NDProxy.sys and enables local privilege escalation through improper input validation, the likely exposure is not just a software defect but a path from limited access to higher privilege on an already-compromised host.

Why local privilege escalation changes the response

Privilege escalation vulnerabilities matter because they frequently turn a low-privilege foothold into control of the operating system. That changes incident priority: even if the attacker still needs initial access, the flaw can shorten the path to full system takeover, disablement of controls, credential access, or lateral movement.

MITRE ATT&CK Enterprise Matrix is a useful lens here because privilege escalation is often the bridge between initial access and broader compromise, and that bridge is what defenders should assume the attacker will try to cross.

In practice, the material question is whether the affected Windows systems are internet-facing, reachable by untrusted users, or already showing signs of suspicious local activity that could indicate the flaw has been used as part of a larger intrusion.

What practitioners should do when patching is delayed

Start by confirming exposure at the host level, then reduce the number of users and services that can obtain meaningful local access on those systems. For Windows kernel privilege-escalation issues, delaying patching without reducing the local attack surface is usually an exposure management failure, not a neutral temporary state.

Use the vendor advisory and the KEV catalogue for authoritative version and remediation details, then apply the fix as soon as operationally possible. If patching must wait, increase monitoring for suspicious process creation, privilege changes, driver-related anomalies, and post-exploitation behaviour on the affected endpoints.

If you have evidence that a system may already be compromised, the response should include compromise assessment, not just patching. That may require reviewing administrative actions, checking for persistence, and validating whether attacker activity occurred before the fix was applied.

Risk and Threat Considerations

This kind of kernel privilege escalation is especially dangerous because the attacker only needs local execution once to convert it into stronger control of the machine. On an estate with weak segmentation or shared administrative access, one exploited endpoint can become a springboard for deeper movement.

Failure mechanism: Improper input validation in a kernel component allows a local attacker to trigger privileged behaviour and escape the original permission boundary.

Impact: The attacker may obtain elevated privileges, disable defenses, access protected data, or prepare the host for persistence and lateral movement.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploits require fast exposure tracking and remediation prioritization.
Recommendation — Prioritise and remediate KEV-listed Windows vulnerabilities on affected assets.
MITRE ATT&CK	T1068 — Exploitation for Privilege Escalation	The CVE enables a local attacker to escalate privilege on the host.
Recommendation — Map detections to privilege-escalation behavior and hunt for post-exploitation activity.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE requires rapid identification and correction of a known exploitable flaw.
Recommendation — Patch or mitigate the vulnerable Windows component as quickly as operationally possible.

Practitioner Guidance

What to prioritise: Treat KEV-listed privilege escalation issues as exposure on any host where untrusted code, lower-privilege users, or attacker footholds are plausible. The highest-value decision is whether to isolate, patch, or both before you spend time on root-cause analysis.

What to verify: Confirm whether the vulnerable Windows kernel component is present on in-scope systems and whether any alerts, suspicious privilege changes, or unusual administrative actions occurred before remediation. If you cannot verify host integrity, assume the system may need deeper triage.

Practitioner takeaway: KEV inclusion means the control objective is no longer “is the bug real?”, it is “have we reduced exposure fast enough to stay ahead of known exploitation?”