CVE Database · CVE-2018-8414
CVSS v3.1
8.8
EPSS
73.97%
Published
Aug 15, 2018
Modified
Oct 28, 2025
CISA Known Exploited Vulnerability
Added: 2022-03-25 · Due: 2022-04-15
Apply updates per vendor instructions.
Public PoC / Exploit (2)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HWeaknesses (CWE)
Affected Products (8)
References (7)