Yes. CISA added CVE-2010-0232 to its Known Exploited Vulnerabilities catalogue on 3 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. The kernel in Microsoft Windows, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges.
What “exploited in the wild” means for this CVE
For a vulnerability like CVE-2010-0232, the practical question is not only whether a flaw exists, but whether defenders should treat it as an active exposure. CISA’s KEV listing is the strongest signal here because it reflects evidence of real-world exploitation, not just theoretical risk. For verification and triage, CISA Known Exploited Vulnerabilities Catalog should be your starting point, alongside the CVE Program record and the NIST National Vulnerability Database entry for canonical reference data.
Because this issue is a kernel privilege escalation in Microsoft Windows under a specific legacy configuration, the immediate operational question is whether any still-supported or isolated systems can actually reach that attack surface. If the vulnerable condition cannot exist in your environment, the KEV listing still matters for legacy assets, inherited endpoints, and exception inventories.
What defenders should check first
Start by identifying any Windows endpoints that still allow 16-bit application support on 32-bit x86 builds, then confirm whether those systems are internet-facing, broadly trusted, or difficult to monitor. The highest-value work is exposure validation, not generic patch sprawl. A focused vulnerability process such as Vulnerability Management Guide helps when you need to separate true reachability from historical inventory noise and prioritise by exploitability rather than by CVE count.
If you are assessing multiple legacy issues at once, put this flaw into the same response queue as other KEV-listed items. The point is to confirm whether the vulnerable code path is present, whether the affected host is operationally important, and whether the business can tolerate continued exposure while remediation is scheduled.
How to treat patching, mitigation, and compromise checks
When patching is possible, treat the vendor fix as the primary remediation path and validate it on the exact platform class that remains at risk. If patching must wait, reduce exposure by removing the legacy configuration, restricting user access, and isolating the system from untrusted execution paths. For exploitation-priority work, the FIRST EPSS model can complement KEV by helping you decide which other vulnerabilities deserve faster handling in the same queue.
Because this is a local privilege escalation, you should also look for signs that a lower-privileged account has already been used to pivot to higher privilege on an exposed host. Post-incident review should include authentication logs, unusual process launches, suspicious administrative activity, and any persistence created after privilege gain. Where defenders need a threat-technique lens for that review, MITRE ATT&CK Enterprise Matrix is the right reference for mapping exploitation to privilege escalation and follow-on movement.
Risk and Threat Considerations
A KEV-listed kernel flaw changes the risk posture immediately because active exploitation means the issue has moved from theoretical exposure to likely adversary use. The main threat is privilege escalation on a host that was assumed to be lower risk, which can turn a local foothold into full system control if the vulnerable condition still exists.
Failure mechanism: The kernel fails to validate certain BIOS calls in a legacy Windows execution path, allowing a local user to gain elevated privileges when 16-bit application support is enabled on a 32-bit x86 system.
Impact: An attacker who already has low-level access can escalate to higher privilege, which can enable persistence, tampering, defense evasion, or further compromise on the affected endpoint.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | CVE exploitation response requires timely remediation of known flaws. |
| Recommendation — Track this KEV-listed flaw through SI-2 and remediate every reachable affected host. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation makes vulnerability prioritization and remediation central. |
| Recommendation — Use CIS-7 to prioritize KEV-listed flaws ahead of non-exploited findings. | ||
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | The flaw's material effect is local privilege escalation on Windows hosts. |
| Recommendation — Map detections and hunts to T1068 and look for privilege escalation on exposed endpoints. | ||
| NIST CSF 2.0 | PR.IP-12 — Vulnerability Management | This subject is about managing a known exploited vulnerability in operation. |
| DE.CM-08 — Vulnerability Scans | Exposure confirmation depends on scanning and asset validation for the vulnerable configuration. | |
| Recommendation — Update vulnerability workflows so KEV-listed items are escalated ahead of routine backlog. Scan for systems that still permit the vulnerable legacy configuration and verify remediation. | ||
Practitioner Guidance
What to prioritise: Treat this as an exposure-validation task first, not just a patch task. Confirm whether any asset can actually enter the vulnerable state, then rank affected systems by business criticality, privilege boundary, and visibility of the host.
What to verify: Validate that remediation removed the vulnerable condition, not merely that a ticket was closed. If the system remains in service, verify the legacy feature is disabled, the host is monitored, and no unexpected administrative changes occurred before the fix.
Practitioner takeaway: A KEV listing means the question is no longer “is the flaw real?”, it is “where is it still reachable, and what would an attacker gain if they hit it before you retire or remediate the system?”
Related resources from NHI Mgmt Group
- Guide: Zero-Day and Exploited Vulnerabilities Guide
- CVE-2010-0232 (Microsoft Windows Kernel Exception Handler)
- Is CVE-2025-21334 (Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free) being exploited in the wild?
- Is CVE-2024-35250 (Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability) being exploited in the wild?
- Is CVE-2010-2568 (Microsoft Windows Remote Code Execution) being exploited in the wild?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org