What is the CVSS score of CVE-2018-8439?

CVE-2018-8439 has a CVSS 3.0 base score of 8.4 (High). CVSS vector: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 4.3%.

Is there a patch available for CVE-2018-8439?

Yes, a patch is available for CVE-2018-8439. Update the affected software to the latest version immediately.

Windows 10 CVE-2018-8439

HIGH

Improper Input Validation (CWE-20)

2018-09-13 secure@microsoft.com

Microsoft RCE Windows 10 Windows 8 1 Windows Rt 8 1 Windows Server 2012 Windows Server 2016

8.4

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Sep 13, 2018 - 00:29 nvd

HIGH 8.4

DescriptionNVD

A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Windows Hyper-V Remote Code Execution Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-0965.

AnalysisAI

A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Windows Hyper-V Remote. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-20. A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Windows Hyper-V Remote Code Execution Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-0965. Affected products include: Microsoft Windows 10, Microsoft Windows 8.1, Microsoft Windows Rt 8.1, Microsoft Windows Server 2012, Microsoft Windows Server 2016.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.