CVE-2016-0099: Windows Secondary Logon Service handle handling privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with known ransomware use and public exploits, but requires an existing local foothold and low privileges rather than remote access.

What it is

The Secondary Logon Service in multiple Windows versions fails to properly process request handles, a flaw classified as a classic buffer overflow (CWE-120). A local user can run a crafted application to elevate privileges on the affected host. Because it yields full system rights from a low-privileged local account, it is a standard post-compromise escalation step.

Impact

An attacker with a local foothold gains elevated privileges, typically SYSTEM, on the target machine. That access enables credential theft, disabling of security controls and lateral movement.

Attack surface

Reached locally by executing a crafted application on the affected Windows host; the CVSS vector AV:L/PR:L/UI:N indicates a local attacker with low privileges and no user interaction. No remote or network path is described.

Exploitation

CISA KEV lists it as exploited in the wild with known ransomware campaign use, and multiple public Exploit-DB entries exist; EPSS 30-day probability is 0.372 (98.4th percentile).

What to do

• Apply the Microsoft MS16-032 security update to all affected Windows versions, prioritizing Windows 7, 8.1, Server 2008/2012 and Windows 10 Gold/1511.
• Retire or isolate unsupported builds such as Vista SP2 and Windows Server 2008 SP2/R2 SP1 that cannot be patched.
• Restrict local logon and interactive access so untrusted users cannot run arbitrary code on these hosts.
• Monitor and constrain use of the Secondary Logon (seclogon) service where business needs allow.
• Hunt for and remove commodity privilege-escalation tooling and scripts that target this flaw.

Detection

• Alert on unexpected child processes spawned by seclogon or svchost hosting the Secondary Logon service.
• Monitor for processes gaining SYSTEM integrity from a medium-integrity parent, especially short-lived executables in user-writable paths.
• Correlate local privilege-escalation exploit artifacts with subsequent credential dumping or ransomware behavior.
• Audit hosts still running unpatched builds listed in MS16-032 and flag them for remediation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.