Description
The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709 Windows Server 2016 and Windows Server, version 1709 allows a remote code execution vulnerability due to how CredSSP validates request during the authentication process, aka "CredSSP Remote Code Execution Vulnerability".
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Windows | Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709 Windows Server 2016 and Windows Server, version 1709 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | freerdp | 2.0.0~rc4-3.3.1 | SUSE-SU-2019:0539-1 |
| SLES 12 SP5 | freerdp | 2.1.2-12.20.1 | SUSE-SU-2020:2272-1 |
| SLES 12 SP5 | vinagre | 3.20.2-16.3.3 | SUSE-SU-2020:2272-1 |
| SLES 12 SP4 | freerdp | 2.0.0~git.1463131968.4e66df7-12.8.1 | SUSE-SU-2019:0134-1 |
| SLES 12 SP3 | freerdp | 2.0.0~git.1463131968.4e66df7-12.8.1 | SUSE-SU-2019:0134-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | freerdp2 | 2.4.0-2.1 | openSUSE-SU-2024:10768-1 |
| openSUSE Tumbleweed | python-pyspnego | 0.5.0-1.1 | openSUSE-SU-2025:15103-1, openSUSE-SU-2024:12385-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Microsoft Credential Security Support Provider - Remote Code Execution EDB-44453 · remote · Apr 13, 2018
GitHub 1 repository
-
preempt/credssp ★ 268 · Apr 2, 2018
A code demonstrating CVE-2018-0886
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 8
- openSUSE-SU-2025:15103-1 python311-pyspnego-0.11.2-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0134-1 Security update for freerdp SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10768-1 freerdp-2.4.0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:2272-1 Security update for freerdp SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12385-1 python310-pyspnego-0.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0539-1 Security update for freerdp SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-18-198-03 PEPPERL+FUCHS VisuNet RM, VisuNet PC, and Box Thin Client CISA ICS & IT advisories · Jul 17, 2018
- VDE-2018-008 Pepperl+Fuchs: Remote Code Execution Vulnerability in HMI Devices CERT@VDE · Jul 6, 2018