Yes. CISA added CVE-2002-0367 to its Known Exploited Vulnerabilities catalogue on 3 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges.
What it means to be exploited in the wild
For a CVE question like this, the practical answer is not abstract vulnerability theory, it is whether the flaw has crossed from disclosure into observed attacker use. CISA’s KEV catalogue is the key signal here because it records vulnerabilities with reliable evidence of active exploitation, which changes the response from routine tracking to urgent exposure handling. The fact pattern also matters operationally because a privilege-escalation flaw can be used after any initial local foothold.
When the issue is a Windows local privilege escalation, the first question is whether any system you manage still exposes the vulnerable condition, especially on hosts that already allow local code execution, remote access tooling, or untrusted user activity. Even old vulnerabilities can remain relevant when legacy systems, imaging, or long-lived endpoints are still in service.
Why exploitation status changes the response
Once a vulnerability is confirmed as actively exploited, triage should shift from normal backlog management to blast-radius reduction. CISA Known Exploited Vulnerabilities Catalog is the authoritative place to confirm that status and to check the remediation expectation attached to it. For defenders, the operational impact is that patch delay becomes a risk decision, not a neutral scheduling choice.
Because this class of bug allows privilege gain on a local system, the security consequence is often larger than the vulnerability description suggests. A successful exploit can turn a low-privilege foothold into administrative control, which then changes what an attacker can do next, such as disabling defenses, persisting, or reaching adjacent systems where the compromised account or host has trusted access.
What to check before and after remediation
Start by confirming whether the vulnerable Windows builds are still present anywhere in the environment, including test, lab, VDI, and overlooked legacy assets. If the fix cannot be applied immediately, reduce exposure by restricting who can log on locally, removing unnecessary software that grants user execution paths, and increasing monitoring on systems that could be used as a launch point for privilege escalation.
Then look for signs that the host was already used as a stepping-stone. On a privilege-escalation issue, the compromise question is not only “was the patch applied?” but also “did an attacker already use local access to obtain elevated rights?” That means reviewing authentication logs, privilege changes, new services, scheduled tasks, and unexpected administrator activity on the affected systems.
Risk and Threat Considerations
Actively exploited privilege-escalation bugs are especially dangerous because they reward any earlier compromise with higher access. Even when the initial foothold is low privilege, the exploit can collapse containment by turning a single user session into full system control, which makes detection and cleanup materially harder.
Failure mechanism: An attacker first obtains local execution or a usable user context, then uses the Windows flaw to break the intended trust boundary and run with administrator or SYSTEM privileges.
Impact: The compromise can expand from one account or workstation into credential theft, defense tampering, lateral movement, or durable persistence on the host.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | CVE-2002-0367 is a local privilege escalation path. |
| Recommendation — Map host telemetry to privilege-escalation activity and hunt for post-exploit elevation. | ||
| NIST CSF 2.0 | DE.CM-01 — Continuous Monitoring | Active exploitation calls for continuous exposure and compromise monitoring. |
| RC.RP-01 — Recovery Plan Executed | Known exploitation requires coordinated remediation and recovery actions. | |
| Recommendation — Monitor affected hosts for elevation, persistence, and abnormal admin activity. Execute your recovery plan to patch, verify, and restore affected systems. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | A KEV-listed CVE belongs in urgent vulnerability management and remediation. |
| Recommendation — Prioritize and remediate the exploited vulnerability on exposed Windows systems. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The issue requires prompt remediation of a known exploited flaw. |
| Recommendation — Patch or mitigate the Windows flaw and validate removal from the environment. | ||
Practitioner Guidance
What to prioritise: Treat any KEV-listed privilege-escalation issue as an exposure-management problem first and a patching problem second. If the vulnerable host is internet-adjacent, user-facing, or already exposed to untrusted code execution, it deserves immediate handling because the exploit path is already proven in the wild.
What to verify: Confirm three things before closing the ticket: the vulnerable condition is absent, the host was not already abused for elevation, and the system still has no unnecessary local access paths that would make the same class of exploit useful again. If any of those checks fail, the incident is not finished just because the patch landed.
Practitioner takeaway: For KEV-listed privilege escalation flaws, the right question is not “is there a patch?” but “has the host already been used as a foothold, and what does elevated access let an attacker do next?”
Related resources from NHI Mgmt Group
- Guide: Zero-Day and Exploited Vulnerabilities Guide
- Is CVE-2014-1812 (Microsoft Windows Group Policy Preferences Password Privilege Escalation) being exploited in the wild?
- Is CVE-2024-38107 (Microsoft Windows Power Dependency Coordinator Privilege Escalation) being exploited in the wild?
- Is CVE-2019-1388 (Microsoft Windows Certificate Dialog Privilege Escalation) being exploited in the wild?
- Is CVE-2021-43226 (Microsoft Windows Privilege Escalation) being exploited in the wild?