CVE-2016-0099

CVE-2016-0099 is a privilege escalation flaw in the Windows Secondary Logon Service, which fails to properly manage request handles in memory. An attacker who can already execute code on a vulnerable Windows system triggers the flaw through the service's request handling and gains the ability to run arbitrary code as administrator, converting a low-privilege foothold into full system control. Microsoft Windows systems lacking the vendor's updates are affected; the CISA data lists the impacted product only as 'Microsoft Windows' without specific version ranges. Exploitation is confirmed in the wild: CISA added the bug to its Known Exploited Vulnerabilities catalog on 2022-03-03 with known ransomware use, and EPSS places the 30-day exploitation probability at 37.2% (98th percentile). No public proof-of-concept is cataloged in the source data.

What to do: Apply Microsoft's March 2016 security updates (MS16-032) on all Windows systems, per the vendor instructions required by the CISA KEV entry, prioritizing legacy and internet-reachable hosts. On systems that cannot be patched, disable the Secondary Logon service as a mitigation (noting that 'Run as' will stop working), and hunt for local privilege-escalation and ransomware-staging activity on unpatched Windows machines.