Is CVE-2015-0016 (Microsoft Windows TS WebProxy Directory Traversal) being exploited in the wild?

Yes. CISA added CVE-2015-0016 to its Known Exploited Vulnerabilities catalogue on 25 May 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Directory traversal vulnerability in the TS WebProxy (TSWbPrxy) component in Microsoft Windows allows remote attackers to escalate privileges. Any organisation running the affected product should treat remediation as urgent.

What active exploitation means for a Windows vulnerability

Once a CVE lands in CISA’s Known Exploited Vulnerabilities catalogue, the question is no longer abstract exposure, it becomes operational triage. For defenders, that means confirming whether the vulnerable Windows service exists anywhere in the estate, whether it is internet-facing or reachable from less trusted networks, and whether compensating controls already reduce the blast radius.

For a directory traversal flaw, the immediate concern is that attackers may be able to reach files or paths they should not see, then turn that foothold into privilege escalation or broader system access. The important distinction is not just whether the product is installed, but whether the vulnerable component is enabled, reachable, and still trusted by downstream systems.

What to do when patching cannot happen immediately

When remediation is not instant, the goal is to shrink exposure while preserving enough service to operate safely. That usually means restricting access to the affected Windows component, removing unnecessary exposure to untrusted networks, and tightening monitoring around requests that look like traversal or file access abuse.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog for authoritative remediation details, and validate whether any compensating control actually blocks the attack path rather than merely reducing noise. If you cannot patch quickly, treat the system as higher risk until you have verified that the reachable surface is constrained and the vulnerable path is not exposed to ordinary user traffic.

The right short-term decision is often to reduce trust in the affected service rather than to assume it is safe because it sits behind a perimeter. Traversal bugs are frequently reachable through ordinary application flows, so compensating controls should be tested against realistic request patterns, not policy statements.

How to check for earlier compromise and side effects

Because CISA only lists vulnerabilities with reliable evidence of active exploitation, you should also ask whether the host has already been touched. Review web and system logs for anomalous path sequences, unexpected access to parent directories, privilege changes, failed attempts followed by success, and any sign that the service began behaving differently after suspicious requests.

If the vulnerable component had access to sensitive files, configuration data, or service-level credentials, confirm whether that material may have been exposed. The investigation should cover account, session, or service identity reuse wherever the flawed component could have disclosed material that enables follow-on access, because one successful traversal can create a larger compromise than the original bug suggests.

Risk and Threat Considerations

An exploited directory traversal flaw can expose files outside the intended root, then let an attacker move from file access to privilege escalation, credential exposure, or persistent access. The practical risk is not only unauthorized reading, but also the possibility that the attacker can use what they learn to deepen compromise or pivot to other systems.

Failure mechanism: The vulnerable component accepts path input that can escape the intended directory boundary, so requests intended for normal content retrieval are redirected into files or locations the service should never disclose.

Impact: Attackers may read sensitive data, steal credentials, alter configuration, or use the exposed material to gain higher privileges and widen access across the environment.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation requires rapid identification, prioritization, and remediation of vulnerable assets.
Recommendation — Prioritize and remediate affected systems using continuous vulnerability management.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The question hinges on confirming exposure and tracking a KEV-listed vulnerability across systems.
	SI-2 — Flaw Remediation	A KEV-listed flaw demands urgent corrective action and verification of mitigation.
Recommendation — Scan for the vulnerable component and track remediation until exposure is removed. Apply and verify the vendor fix or compensating mitigation without delay.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	Exploitation in the wild often begins through a reachable public-facing service or interface.
Recommendation — Hunt for public-facing exploitation patterns and review ingress paths for abuse.
OWASP ASVS	V4 — API and Web Service	Directory traversal is a web/service input handling issue that affects path access boundaries.
Recommendation — Validate request handling and path controls on exposed web services.

Practitioner Guidance

What to verify: Confirm the vulnerable Windows component is actually present, enabled, and reachable on every host, then verify that remediation changed the attack surface rather than just the ticket status. If the service cannot be removed immediately, make sure monitoring can distinguish ordinary requests from traversal-like access patterns.

Decision rule: If the host handled sensitive data or privileged operations, treat compromise assessment and credential review as part of remediation, not as an optional follow-up. If you find suspicious access history, rotate any exposed secrets or service credentials before you normalise the system back into production use.

Practitioner takeaway: For an actively exploited CVE, speed matters, but exposure validation matters just as much, because the safest remediation is the one that closes the exploit path and also proves the system was not already used as an entry point.