CVE-2015-1701

CVE-2015-1701 is a local elevation-of-privilege vulnerability in Win32k.sys, the Windows kernel-mode driver, that allows a local attacker to execute arbitrary code with kernel-level (SYSTEM) privileges. It is triggered by running a specially crafted application on an affected Windows system, where mishandled user-mode objects in the kernel let the attacker escape a limited user context. An attacker who already has a normal user foothold can escalate to full system rights, enabling persistence and lateral movement; in documented campaigns it was chained with other exploits to move from remote code execution to complete system compromise. Any unpatched Microsoft Windows installation carrying the vulnerable Win32k.sys is affected; the CISA description explicitly cites Microsoft Windows Server, and this kernel-mode driver ships with Microsoft's Windows server and client releases. Exploitation is confirmed in the wild: CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2022-03-03 with known ransomware use, and the 56.2% EPSS (99th percentile) indicates a high probability of exploitation in the next 30 days; no public PoC is known.

What to do: Apply Microsoft's Windows security update for this CVE (bulletin MS15-051, released with the April 2015 Patch Tuesday) on all Windows client and server systems, prioritizing servers, terminal services hosts, and any machine where untrusted users can execute code, and audit the estate for legacy systems still missing the fix. As an interim control where patching is delayed, restrict local code execution to trusted accounts, and hunt for post-compromise indicators given the flaw's use as a 2015 APT28 zero-day and its documented use in ransomware chains per the CISA KEV entry.