CVE-2018-8414

Microsoft's Windows Shell improperly validates file paths in certain Windows 10 and Windows Server releases, a remote code execution flaw rooted in improper input validation (CWE-20). The flaw is triggered when the shell processes a specially crafted file path, typically requiring the victim to interact with a malicious file, as reflected in the CVSS user-interaction (UI:R) requirement. Successful exploitation lets an attacker execute arbitrary code in the context of the current user, with high impact on confidentiality, integrity, and availability. Affected products are Windows 10 versions 1703, 1709, and 1803 and Windows Server (Semi-Annual Channel) versions 1709 and 1803. The bug was patched in Microsoft's August 2018 Patch Tuesday after being reported as one of two zero-days actively exploited in attacks in the wild, was later added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-25, and EPSS currently estimates a 74% probability of exploitation within 30 days.

What to do: Apply Microsoft's August 2018 security updates or later cumulative updates for Windows 10 1703/1709/1803 and Windows Server 1709/1803, consistent with Microsoft guidance and CISA's KEV required action; because these builds are now legacy, upgrading to a currently supported Windows release is the durable fix. Until patched, treat untrusted files and shortcuts with caution since exploitation requires user interaction. Inventory endpoints for the affected builds to confirm they are fully remediated.