CVE-2017-8563

—

CVSS 3.0

8.1 high

EPSS

7%p94

Published

Jul 11, 2017 (Jul 11, 2017)

Modified

Jun 17, 2026

Description

Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to Kerberos falling back to NT LAN Manager (NTLM) Authentication Protocol as the default authentication protocol, aka "Windows Elevation of Privilege Vulnerability".

Vendors: microsoft
Products: windows 10, windows 7, windows 8.1, windows rt 8.1, windows server 2008, windows server 2012, windows server 2016
Weakness: CWE-281
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (7.2%)

In the news3 stories

MS Patch Tuesday fixes 19 critical issues, including two NTLM zero

Security AffairsJul 12, 13:32 UTC · Jul 12, 2017Vulnerability CVE-2017-8563

Critical Flaws Found in Windows NTLM Security Protocol

The Hacker NewsJul 12, 07:23 UTC · Jul 12, 2017Exploit / PoC CVE-2017-8563

Microsoft patches domain-controller vulnerability impacting all Windows versions

CyberScoopJul 11, 21:10 UTC · Jul 11, 2017Vulnerability CVE-2017-8563