CVE-2018-8495: Windows Shell URI handling remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 7.5 with high EPSS and a public exploit reference, though no KEV listing and user interaction is required.

What it is

Windows Shell improperly handles URIs, allowing a crafted URI to trigger remote code execution. The flaw is classified as path traversal (CWE-22) and affects Windows 10 and Windows Server 2016. It matters because successful exploitation gives full code execution on the host.

Impact

An attacker who convinces a user to open a malicious URI can execute arbitrary code in the context of the logged-on user, gaining control of confidentiality, integrity and availability on the affected system.

Attack surface

Reached over the network through a crafted URI that the user must open or interact with; the CVSS vector shows no privileges required but user interaction required (UI:R). No authentication is needed.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.50729, 98.9th percentile) and public references include an exploit write-up, indicating known exploitation techniques exist.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com advisory CVE-2018-8495).
• Restrict or block untrusted URI handlers and schemes via Group Policy or registry where feasible.
• Educate users not to open unsolicited links or URI prompts from untrusted sources.
• Keep Windows 10 and Windows Server 2016 systems current with cumulative updates.

Detection

• Monitor process creation for shell or browser processes spawning unexpected child processes after URI handling.
• Alert on unusual outbound network connections originating from shell or browser processes.
• Review Windows event logs and application logs for abnormal URI handler invocations.
• Track execution of known exploit artifacts tied to public proof-of-concept references.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.