CVE-2018-8414

A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10.

Affected

Microsoft · Windows 10 Servers · Windows 10

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

72.91% chance of exploitation in the next 30 days, 99th percentile

CISA KEV

added 2022-03-25

Published

2018-08-15

Updated

2025-10-21

Proof-of-concept exploits (1)

• whereisr0da/CVE-2018-8414-POC21★ · 2020-09-21

Security advisories

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8414
• http://www.securityfocus.com/bid/105016
• http://www.securitytracker.com/id/1041458

References

• CVE Record
• NVD entry

Related

• CVE-2018-8353
• CVE-2018-8495