Microsoft Windows CSRSS Security Feature Bypass Vulnerability (CVE-2016-0151)

What is affected, what to do

The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft Windows Server 2012 eq r2..r2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory legacy assets: Use CMDB, EDR or AD to find Windows 8.1, Windows RT 8.1, Windows Server 2012 (Gold and R2), and Windows 10 RTM (1507) and 1511. Example: Get-ADComputer -Filter * -Properties OperatingSystem,OperatingSystemVersion | ? {$_.OperatingSystemVersion -match "^(6\.3|6\.2|10\.0 \(10240\)|10\.0 \(10586\))"}. All of these builds are end-of-life or ESU-only. Treat every hit as a risk asset.
   • Deploy the security update: Install, or verify the presence of, the April 2016 Patch Tuesday update (bulletin MS16-048). Any current cumulative update or Monthly Rollup also supersedes it. The exact KB per OS is in the vendor advisory — please look it up there. Confirm patch status via Get-HotFix or WSUS/ConfigMgr compliance reports.
   • Isolate unpatchable or EOL hosts: Windows 10 1507/1511 no longer receive updates. Move such hosts into a dedicated segment and restrict interactive logon to a named admin group.
   • Hunt for compromise on legacy hosts: This is a local privilege escalation, normally the second stage after initial access. Review 30 days of EDR telemetry for new SYSTEM processes originating from user contexts (see Detection rules).
   • Rotate credentials if suspicious: If escalation is suspected, reset local admin passwords (LAPS) and the passwords of every privileged account that logged on to the host. Also check for LSASS access.
2. 02

   Runbook step 2

   Mitigation layers

   • Application control (endpoint hardening): Exploitation requires a crafted application. Enforce AppLocker or WDAC rules that block execution from %USERPROFILE%, %TEMP%, %APPDATA% and C:\Users\Public. This is the most effective compensating control.
   • Least privilege / IAM: Strip local admin rights from standard users. Restrict RDP and interactive logon via GPO (SeInteractiveLogonRight, SeRemoteInteractiveLogonRight). Block Tier-0 accounts from logging on to Server 2012/R2 hosts.
   • Network segmentation: Put legacy hosts in their own VLAN. Permit SMB (445/tcp), RDP (3389/tcp) and WinRM (5985/5986/tcp) only from admin jump hosts. Restrict egress to a proxy allow-list to hinder tool staging and C2.
   • Enforce EDR coverage: Ensure EDR runs in blocking mode on all affected hosts. Where the current agent no longer supports the legacy OS, formally document the risk and prioritise migration.
   • Migration plan (configuration layer): Windows 8.1 and Windows 10 1507/1511 are permanently unpatchable. Record a binding decommissioning date in the risk register (ISO 27001 A.8.8, management of technical vulnerabilities).
3. 03

   Runbook step 3

   Detection rules

   • SYSTEM process with a user-context parent (Sysmon EID 1 / Security 4688): Look for a child process with IntegrityLevel=System or User=NT AUTHORITY\SYSTEM whose parent runs as a standard user at medium integrity. Sigma shape: selection: IntegrityLevel: 'System' and ParentUser|not: 'NT AUTHORITY\SYSTEM'; filter known services and installers.
   • Shells launched from user directories (EDR process ancestry): Look for cmd.exe, powershell.exe or whoami.exe running as SYSTEM with an ancestor binary under \Users\*\AppData\ or \Temp\. KQL: DeviceProcessEvents | where AccountSid == "S-1-5-18" and InitiatingProcessFolderPath has_any ("\\AppData\\","\\Temp\\").
   • Handle access to csrss.exe (Sysmon EID 10): Alert when TargetImage ends in \csrss.exe and SourceImage is not a system process (exclude lsass.exe, services.exe, wininit.exe, AV/EDR). Flag unusual GrantedAccess masks such as 0x1fffff or 0x1410.
   • Unexpected privilege assignment (Security 4672): Alert on 4672 events with SeDebugPrivilege or SeTcbPrivilege for accounts or logon IDs previously seen only as standard users. Correlate with 4624 (logon type 2/10) on the same host.
   • Post-escalation follow-on activity: Shortly after any of the hits above, watch for vssadmin delete shadows, wbadmin delete catalog, bcdedit /set recoveryenabled no, or new local admins (Security 4720/4732). These are typical precursors to ransomware encryption.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Microsoft Windows 10 1507
• Microsoft Windows 10 1511
• Microsoft Microsoft Windows 8.1
• Microsoft Microsoft Windows RT 8.1
• Microsoft Microsoft Windows Server 2012

Weakness classes (CWE)

• CWE-269Improper Privilege Management

  Class

  The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

  Entry at MITRE CWE-269

References & sources

• docs.microsoft.comMS16-048Vendor advisory, x_refsource_MS, Patch, Vendor advisory
• securitytracker.com1035544Vulnerability database, x_refsource_SECTRACK, Broken link, Third-party advisory, Vulnerability database
• exploit-db.com39740Exploit, x_refsource_EXPLOIT-DB, Exploit, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0151government-resource, US government resource