CVE-2018-0886

7.0 highEPSS 82%

The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709 Windows Server 2016 and Windows Server, version 1709 allows a remote code execution vulnerability due to how CredSSP validates request during the authentication process, aka "CredSSP Remote Code Execution Vulnerability".

Severity

CVSS 3.0

7.0 high

CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 82% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2018-03-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

microsoft:windows_10
microsoft:windows_7
microsoft:windows_8.1
microsoft:windows_rt_8.1
microsoft:windows_server_2008
microsoft:windows_server_2012
microsoft:windows_server_2016

References

http://www.securityfocus.com/bid/103265
http://www.securitytracker.com/id/1040506
https://blog.preempt.com/security-advisory-credssp
https://github.com/preempt/credssp
https://ics-cert.us-cert.gov/advisories/ICSA-18-198-03

Check your stack JSON