CVE-2016-3213: Windows WPAD fallback flaw allows privilege elevation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.8 with no privileges required and high EPSS, though user interaction is needed and no KEV listing or known exploit code is recorded.

What it is

The Web Proxy Auto Discovery (WPAD) implementation in Microsoft Windows and Internet Explorer uses an improper fallback mechanism when locating a proxy configuration. A remote attacker able to answer NetBIOS name queries can supply a malicious WPAD response and gain elevated privileges on the target host. The flaw affects a broad set of legacy Windows releases and IE 9 through 11.

Impact

An attacker who wins the WPAD name resolution can redirect the victim's proxy traffic and execute code or obtain credentials in the context of the affected system, leading to full compromise of confidentiality, integrity and availability.

Attack surface

Reachable over the network via NetBIOS name responses; the CVSS vector shows no privileges required but user interaction is required, meaning the victim must trigger WPAD resolution (for example by browsing or opening a document that causes proxy discovery).

Exploitation

Not listed in CISA KEV and no reference tags indicate public exploit code, but EPSS is high (0.669, 99.3rd percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the Microsoft security updates MS16-063 and MS16-077 to all affected Windows and Internet Explorer versions.
• Disable automatic proxy discovery (WPAD) via Group Policy or registry where it is not operationally required.
• Disable or restrict NetBIOS name resolution (NetBIOS over TCP/IP) and block WPAD-related name queries at network boundaries.
• Remove or deprecate unsupported platforms such as Windows Vista, Windows 7 and Windows Server 2008 from the environment.
• Monitor and restrict outbound proxy auto-configuration traffic to trusted internal WPAD servers only.

Detection

• Monitor DNS and NetBIOS name resolution logs for unexpected WPAD or wpad hostname queries and responses.
• Alert on hosts retrieving proxy auto-config (PAC) files from non-approved or external sources.
• Baseline and review proxy settings changes on endpoints, especially sudden shifts to attacker-controlled proxy servers.
• Correlate NetBIOS name service (UDP 137/138) anomalies with subsequent authentication or code execution events on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.