CVE-2016-3300
Last modified
CVE-2016-3300 is a vulnerability of currently unknown severity. The Netlogon service in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 improperly establishes secure communications channels, which allows local users to gain privileges by leveraging access to a domain-joined machine, aka "Netlogon Elevation of Privilege Vulnerability.". EPSS estimates a 1.31% chance of exploitation in the next 30 days.
Description
The Netlogon service in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 improperly establishes secure communications channels, which allows local users to gain privileges by leveraging access to a domain-joined machine, aka "Netlogon Elevation of Privilege Vulnerability."
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows 8.1 | All versions |
| Microsoft | Windows Rt 8.1 | All versions |
| Microsoft | Windows Server 2012 | All versions |
| Microsoft | Windows Server 2012 | r2 |
References
- http://www.securityfocus.com/bid/92296Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1036576Third Party Advisory, VDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-101Patch, Vendor Advisory
- http://www.securityfocus.com/bid/92296Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1036576Third Party Advisory, VDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-101Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-3300?
How severe is CVE-2016-3300?
How do I fix CVE-2016-3300?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-3294Microsoft Edge allows remote attackers to execute arbitrary …
- CVE-2016-3295Microsoft Internet Explorer 10 and 11 and Microsoft Edge all…
- CVE-2016-3296The Chakra JavaScript engine in Microsoft Edge allows remote…
- CVE-2016-3297Microsoft Internet Explorer 9 through 11 and Microsoft Edge …
- CVE-2016-3298Microsoft Internet Explorer 9 through 11 and the Internet Me…6.5
- CVE-2016-3299Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 …
- CVE-2016-3301The Windows font library in Microsoft Windows Vista SP2; Win…
- CVE-2016-3302Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.…
- CVE-2016-3303The Windows font library in Microsoft Windows Vista SP2, Win…
- CVE-2016-3304The Windows font library in Microsoft Windows Vista SP2, Win…
- CVE-2016-3305The kernel in Microsoft Windows Vista SP2, Windows Server 20…
- CVE-2016-3306The kernel in Microsoft Windows Vista SP2, Windows Server 20…
Are you affected by CVE-2016-3300?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST
