# CVE-2018-8414

A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10.

- Page: https://www.vulneraibility.com/cve/CVE-2018-8414
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2022-03-25; CISA due date 2022-04-15
- EPSS: 72.62% (percentile 99.5)
- Unvetted proof-of-concept code on GitHub: 1 GitHub proof of concept (first 2018-08-24)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-02-07)
- Weakness: CWE-20
- Published: 2018-08-15

## Affected versions

- Microsoft Windows 10: affected Version 1703 for 32-bit Systems; Version 1703 for x64-based Systems; Version 1709 for 32-bit Systems; Version 1709 for x64-based Systems; Version 1803 for 32-bit Systems; Version 1803 for x64-based Systems
- Microsoft Windows 10 Servers: affected version 1709  (Server Core Installation); version 1803  (Server Core Installation)

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8414
- [other] http://www.securityfocus.com/bid/105016
- [other] http://www.securitytracker.com/id/1041458
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8414

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.