Yes. CISA added CVE-2017-0213 to its Known Exploited Vulnerabilities catalogue on 28 March 2022, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application. Any organisation running the affected product should treat remediation as urgent.
What this CVE means operationally
CVE-2017-0213 is not a theoretical weakness to file away for later. Once CISA places a CVE in the Known Exploited Vulnerabilities catalogue, the practical assumption changes: exposure is already being used by real attackers, and the priority becomes confirming whether the vulnerable Windows systems exist anywhere in the environment and whether they are reachable by untrusted code.
The core issue here is privilege escalation through Microsoft Windows COM Aggregate Marshaler. That matters because exploitation can convert an initial foothold, often with ordinary user execution, into higher privilege on the same host. For defenders, the important question is not only whether the product exists, but where code execution, software installation, or user-launched applications are allowed to run.
For a broader exploitation context, the Zero-Day and Exploited Vulnerabilities Guide covers the triage pattern practitioners should use when a CVE has confirmed in-the-wild use, including KEV-driven prioritisation and post-patch validation.
Why confirmed exploitation changes the response
Confirmed exploitation in the wild changes the decision logic. At that point, patching is no longer just routine hygiene, it becomes a containment and exposure-reduction task. Delays create a larger window for privilege escalation from an already compromised endpoint, especially where the vulnerable system is used by administrators, developers, or service operators.
Ransomware relevance raises the stakes further because it suggests the vulnerability is not only being tested, but is valuable in post-compromise operations. That usually means defenders should assume exploitation attempts may be opportunistic, repeatable, and already embedded in commodity intrusion playbooks.
The best next reference point is the CISA Known Exploited Vulnerabilities Catalog, which is the authoritative source for the KEV status that drives remediation urgency.
For deeper remediation workflow, the Vulnerability Management Guide is the most useful internal companion because it maps KEV status to prioritisation, verification, and exception handling.
What to check before and after remediation
Start by confirming whether any Windows assets in scope still run the affected product, then check whether those systems have been exposed to untrusted application execution, remote access tooling, or unusual privilege changes. If the host was reachable and unpatched during the KEV window, treat it as a candidate for compromise review, not just a patch ticket.
After remediation, validate that the vulnerable condition is actually gone and that no persistence was added while the system was exposed. On Windows endpoints, that means looking for new local admins, scheduled tasks, suspicious services, unusual startup items, and signs that the attacker used the elevated context to move laterally or harvest credentials.
If you need a control lens for the escalation path itself, the MITRE ATT&CK Enterprise Matrix helps map the likely follow-on behaviours after privilege escalation, including credential access and lateral movement.
Risk and Threat Considerations
Once a privilege-escalation CVE is publicly exploited, the main risk is not just local elevation, but what that elevation unlocks next. An attacker who can run a crafted application on a vulnerable Windows host may turn a low-privilege foothold into broader access, especially if the system holds cached credentials, admin sessions, or access to internal tooling.
Failure mechanism: The flaw enables privilege escalation through COM Aggregate Marshaler, so a successful initial execution path can be converted into higher local authority and then abused for persistence, credential access, or lateral movement.
Impact: The exposed host can become a stepping stone for broader intrusion, including ransomware deployment, admin takeover, and rapid spread across adjacent systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE needs urgent exposure validation, prioritisation, and remediation tracking. |
| Recommendation — Prioritise and remediate KEV-listed exposure quickly, then verify closure. | ||
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | The CVE is a privilege-escalation path attackers exploit after initial access. |
| Recommendation — Map host telemetry to privilege-escalation activity and hunt for follow-on abuse. | ||
| NIST CSF 2.0 | PR.IP-12 — Vulnerability Management | A KEV-listed exploited CVE requires disciplined remediation and verification. |
| Recommendation — Track, remediate, and validate exploited vulnerabilities on an urgent timeline. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The issue requires prompt flaw remediation once active exploitation is confirmed. |
| SI-4 — System Monitoring | Post-exploitation review depends on detecting abnormal activity around the vulnerable host. | |
| Recommendation — Patch or mitigate the flaw and document verification before returning systems to service. Monitor for exploitation indicators and persistence after remediation. | ||
Practitioner Guidance
What to prioritise: Treat every exposed instance as urgent, but prioritise the systems where local privilege would matter most, such as endpoints used by admins, servers with remote management access, and hosts that sit near sensitive internal resources.
What to verify: Confirm the presence of the vulnerable software, confirm the fix or mitigation is applied, and confirm there is no evidence of post-exploitation activity before you close the case.
Practitioner takeaway: For KEV-listed privilege-escalation flaws, remediation and compromise assessment should move together, because the business risk is not the CVE alone, but the attacker’s ability to convert one foothold into durable control.
Related resources from NHI Mgmt Group
- Is CVE-2017-0005 (Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation) being exploited in the wild?
- Is CVE-2014-1812 (Microsoft Windows Group Policy Preferences Password Privilege Escalation) being exploited in the wild?
- Is CVE-2024-38107 (Microsoft Windows Power Dependency Coordinator Privilege Escalation) being exploited in the wild?
- Is CVE-2019-1388 (Microsoft Windows Certificate Dialog Privilege Escalation) being exploited in the wild?