Is CVE-2013-5065 (Microsoft Windows Kernel Privilege Escalation) being exploited in the wild?

What it means when a CVE is in CISA KEV

CISA’s Known Exploited Vulnerabilities catalogue is not a theoretical list. If a CVE appears there, defenders should treat it as evidence that exploitation has already happened or is happening in the wild, so the question shifts from “is this exploitable?” to “are we exposed, and have we already been touched?”

For CISA Known Exploited Vulnerabilities Catalog items, the practical task is to identify whether the vulnerable product is present, whether the vulnerable component is reachable, and whether compensating controls can buy time if patching cannot happen immediately.

Because this CVE affects Microsoft Windows Kernel NDProxy.sys and enables local privilege escalation through improper input validation, the likely exposure is not just a software defect but a path from limited access to higher privilege on an already-compromised host.

Why local privilege escalation changes the response

Privilege escalation vulnerabilities matter because they frequently turn a low-privilege foothold into control of the operating system. That changes incident priority: even if the attacker still needs initial access, the flaw can shorten the path to full system takeover, disablement of controls, credential access, or lateral movement.

MITRE ATT&CK Enterprise Matrix is a useful lens here because privilege escalation is often the bridge between initial access and broader compromise, and that bridge is what defenders should assume the attacker will try to cross.

In practice, the material question is whether the affected Windows systems are internet-facing, reachable by untrusted users, or already showing signs of suspicious local activity that could indicate the flaw has been used as part of a larger intrusion.

What practitioners should do when patching is delayed

Start by confirming exposure at the host level, then reduce the number of users and services that can obtain meaningful local access on those systems. For Windows kernel privilege-escalation issues, delaying patching without reducing the local attack surface is usually an exposure management failure, not a neutral temporary state.

Use the vendor advisory and the KEV catalogue for authoritative version and remediation details, then apply the fix as soon as operationally possible. If patching must wait, increase monitoring for suspicious process creation, privilege changes, driver-related anomalies, and post-exploitation behaviour on the affected endpoints.

If you have evidence that a system may already be compromised, the response should include compromise assessment, not just patching. That may require reviewing administrative actions, checking for persistence, and validating whether attacker activity occurred before the fix was applied.

Risk and Threat Considerations

This kind of kernel privilege escalation is especially dangerous because the attacker only needs local execution once to convert it into stronger control of the machine. On an estate with weak segmentation or shared administrative access, one exploited endpoint can become a springboard for deeper movement.

Failure mechanism: Improper input validation in a kernel component allows a local attacker to trigger privileged behaviour and escape the original permission boundary.

Impact: The attacker may obtain elevated privileges, disable defenses, access protected data, or prepare the host for persistence and lateral movement.

Practitioner Guidance

What to prioritise: Treat KEV-listed privilege escalation issues as exposure on any host where untrusted code, lower-privilege users, or attacker footholds are plausible. The highest-value decision is whether to isolate, patch, or both before you spend time on root-cause analysis.

What to verify: Confirm whether the vulnerable Windows kernel component is present on in-scope systems and whether any alerts, suspicious privilege changes, or unusual administrative actions occurred before remediation. If you cannot verify host integrity, assume the system may need deeper triage.

Practitioner takeaway: KEV inclusion means the control objective is no longer “is the bug real?”, it is “have we reduced exposure fast enough to stay ahead of known exploitation?”

Related resources from NHI Mgmt Group

• Guide: Zero-Day and Exploited Vulnerabilities Guide
• Is CVE-2016-3309 (Microsoft Windows Kernel Privilege Escalation) being exploited in the wild?
• CVE-2013-5065 (Microsoft Windows Kernel Privilege Escalation)
• Is CVE-2014-1812 (Microsoft Windows Group Policy Preferences Password Privilege Escalation) being exploited in the wild?
• Is CVE-2024-38107 (Microsoft Windows Power Dependency Coordinator Privilege Escalation) being exploited in the wild?