CVE-2018-8414

At a glance

Severity: HIGH 8.8
Exploitation: Known exploited (CISA KEV) · added 2022-03-25
Exploited per ENISA since 2022-03-25
EPSS: EPSS 72.62 % · percentile 99 (2026-10-28)
State: PUBLISHED
Published: 2018-08-15
Updated: 2025-10-21
Assigner: microsoft
NVD status: Analyzed

Description

A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CISA-ADP
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
CVSS 2.0	HIGH 9.3	AV:N/AC:M/Au:N/C:C/I:C/A:C	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

CWE-20

European references

ENISA EUVD · EUVD-2018-20051
GCVE · GCVE-0-2018-8414

CERT-FR advisories

CERTFR-2018-AVI-397 — Multiples vulnérabilités dans Microsoft Windows · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_server_1709:-:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*

Affected products

Product	Versions
Microsoft · Windows 10 Servers	affected version 1709 (Server Core Installation) ; affected version 1803 (Server Core Installation)
Microsoft · Windows 10	affected Version 1703 for 32-bit Systems ; affected Version 1703 for x64-based Systems ; affected Version 1709 for 32-bit Systems ; affected Version 1709 for x64-based Systems ; affected Version 1803 for 32-bit Systems ; affected Version 1803 for x64-based Systems

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
CISA Known Exploited Vulnerabilities	CC0 1.0
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD