CVE-2016-3236: Windows WPAD proxy discovery mishandling allows traffic redirection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCritical CVSS (9.8) with network-reachable, no-auth, no-interaction exploitation and very high EPSS, though no confirmed in-the-wild exploitation is recorded.

What it is

The Web Proxy Auto Discovery (WPAD) implementation in multiple Microsoft Windows versions mishandles proxy discovery, allowing remote attackers to redirect network traffic via unspecified vectors. Microsoft classifies this as an elevation of privilege issue (MS16-077). Because WPAD is used automatically by clients to locate proxy configuration, a flaw here can silently reroute traffic for affected hosts.

Impact

An attacker can redirect network traffic from affected Windows systems, potentially intercepting or manipulating communications. The CVSS 3.0 vector indicates high confidentiality, integrity and availability impact, though the description does not detail the exact mechanism or resulting control.

Attack surface

Reachable over the network (AV:N) with no privileges or user interaction required (PR:N, UI:N) per the CVSS vector. The flaw is in automatic proxy discovery, so any affected Windows host performing WPAD lookups is exposed.

Exploitation

Not listed in CISA KEV and no reference tags indicate known exploitation. EPSS is very high (0.7677, 99.5th percentile), suggesting elevated likelihood of exploitation activity, but the record does not confirm in-the-wild use.

What to do

• Apply Microsoft security update MS16-077 on all affected Windows versions.
• Disable WPAD where not required (for example, turn off automatic proxy discovery and the WinHttpAutoProxySvc where feasible).
• Block or control WPAD-related name resolution (WINS/NetBIOS/DNS) and DHCP-provided proxy settings at network boundaries.
• Enforce authenticated, trusted proxy configuration via Group Policy instead of automatic discovery.
• Monitor for unexpected proxy configuration changes or traffic redirection on Windows endpoints.

Detection

• Audit endpoints for enabled WPAD/automatic proxy discovery settings and unexpected proxy configuration changes.
• Monitor network traffic for WPAD name resolution and rogue proxy responses on internal networks.
• Review DHCP and DNS logs for suspicious WPAD or proxy-related entries.
• Alert on anomalous outbound traffic patterns consistent with proxy redirection from Windows hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.