Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-hhdp-285d-akas
Vulnerability ID VCID-hhdp-285d-akas
Aliases CVE-2018-8897
XSA-260
Summary
Status Published
Exploitability 2.0
Weighted Severity 8.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-250 Execution with Unnecessary Privileges
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-8897.json
epss 0.24723 https://api.first.org/data/v1/epss?cve=CVE-2018-8897
epss 0.24723 https://api.first.org/data/v1/epss?cve=CVE-2018-8897
epss 0.24723 https://api.first.org/data/v1/epss?cve=CVE-2018-8897
cvssv3 7 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
archlinux High https://security.archlinux.org/AVG-701
archlinux High https://security.archlinux.org/AVG-702
archlinux High https://security.archlinux.org/AVG-703
archlinux High https://security.archlinux.org/AVG-704
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-8897.json
https://api.first.org/data/v1/epss?cve=CVE-2018-8897
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5715
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10471
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10472
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1087
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10981
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10982
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8897
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1567074 https://bugzilla.redhat.com/show_bug.cgi?id=1567074
AVG-701 https://security.archlinux.org/AVG-701
AVG-702 https://security.archlinux.org/AVG-702
AVG-703 https://security.archlinux.org/AVG-703
AVG-704 https://security.archlinux.org/AVG-704
CVE-2018-8897 Exploit https://github.com/can1357/CVE-2018-8897
CVE-2018-8897 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/local/44697.txt
CVE-2018-8897 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/local/45024.rb
CVE-2018-8897 Exploit https://raw.githubusercontent.com/rapid7/metasploit-framework/b40a1467232a84c19b0c8f16a36e2b9973cab951/modules/exploits/windows/local/mov_ss.rb
RHSA-2018:1318 https://access.redhat.com/errata/RHSA-2018:1318
RHSA-2018:1319 https://access.redhat.com/errata/RHSA-2018:1319
RHSA-2018:1345 https://access.redhat.com/errata/RHSA-2018:1345
RHSA-2018:1346 https://access.redhat.com/errata/RHSA-2018:1346
RHSA-2018:1347 https://access.redhat.com/errata/RHSA-2018:1347
RHSA-2018:1348 https://access.redhat.com/errata/RHSA-2018:1348
RHSA-2018:1349 https://access.redhat.com/errata/RHSA-2018:1349
RHSA-2018:1350 https://access.redhat.com/errata/RHSA-2018:1350
RHSA-2018:1351 https://access.redhat.com/errata/RHSA-2018:1351
RHSA-2018:1352 https://access.redhat.com/errata/RHSA-2018:1352
RHSA-2018:1353 https://access.redhat.com/errata/RHSA-2018:1353
RHSA-2018:1354 https://access.redhat.com/errata/RHSA-2018:1354
RHSA-2018:1355 https://access.redhat.com/errata/RHSA-2018:1355
RHSA-2018:1524 https://access.redhat.com/errata/RHSA-2018:1524
RHSA-2018:1710 https://access.redhat.com/errata/RHSA-2018:1710
RHSA-2018:1711 https://access.redhat.com/errata/RHSA-2018:1711
USN-3641-1 https://usn.ubuntu.com/3641-1/
USN-3641-2 https://usn.ubuntu.com/3641-2/
XSA-260 https://xenbits.xen.org/xsa/advisory-260.html
Data source Metasploit
Description This module exploits a vulnerability in a statement in the system programming guide of the Intel 64 and IA-32 architectures software developer's manual being mishandled in various operating system kerneles, resulting in unexpected behavior for #DB excpetions that are deferred by MOV SS or POP SS. This module will upload the pre-compiled exploit and use it to execute the final payload in order to gain remote code execution.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date May 8, 2018
Platform Windows
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/windows/local/mov_ss.rb
Data source Exploit-DB
Date added July 13, 2018
Description Microsoft Windows - POP/MOV SS Local Privilege Elevation (Metasploit)
Ransomware campaign use Known
Source publication date July 13, 2018
Exploit type local
Platform windows
Source update date July 13, 2018
Source URL https://raw.githubusercontent.com/rapid7/metasploit-framework/b40a1467232a84c19b0c8f16a36e2b9973cab951/modules/exploits/windows/local/mov_ss.rb
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-8897.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.96265
EPSS Score 0.24723
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:06:53.360188+00:00 SUSE Severity Score Importer Import https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml 38.6.0