CVE-2018-8414

Microsoft Windows 10 Servers, Microsoft Windows 10

Published 15 Aug 2018 · updated 17 Jun 2026 · Analyzed

8.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 25 Mar 2022, with a remediation deadline of 15 Apr 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10.

References

www.securityfocus.com/bid/105016 · Broken Link, Third Party Advisory, VDB Entry
www.securitytracker.com/id/1041458 · Broken Link, Third Party Advisory, VDB Entry
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8414 · Patch, Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8414 · US Government Resource