Windows Win32k CVE-2018-8639: 2018 EoP Added to KEV

What to do

1. Find Windows hosts that have not installed updates in years, using your patch tool or Get-HotFix | Sort-Object InstalledOn.
2. Update any machine still lacking the December 2018 fixes, or isolate and replace it if it is out of support.
3. Replace Windows Server 2012/2012 R2 machines: their paid Extended Security Updates ended October 13, 2026.
4. Remove direct internet exposure of legacy IIS and SQL Server hosts, the entry point in the documented attacks.
5. If a legacy server was exposed and unpatched, hunt using AhnLab's Dalbit indicators before assuming it is clean.

How to check if you are affected or compromised

• Check Microsoft Defender detections for Exploit:Win64/CVE-2018-8639!MTB.
• Look for an unexpected local account named main and for Potato-family tools (BadPotato, JuicyPotato, SweetPotato) on servers.
• Search for FRP or LCX tunneling tools, such as frpc.ini in %SystemRoot%\temp, and DNS lookups of *.m00nlight.top.
• Check for BitLocker turned on for data drives without an admin change, the Dalbit extortion step.

What happened#

On December 11, 2018, Microsoft's Patch Tuesday fixed CVE-2018-8639, a privilege escalation bug in Win32k, the kernel side of the Windows graphics and windowing system. The advisory says Win32k "fails to properly handle objects in memory". A user who is already logged on can run a crafted program and execute code in kernel mode. Microsoft credited bear13oy of DBAPPSecurity. At release it was rated "Exploitation More Likely" but not exploited, and Microsoft's advisory data still says that today. NVD scores it CVSS 3.1 7.8. CISA's enrichment on the CVE record gives 8.4.

More than six years later, on March 3, 2025, CISA added the CVE to KEV "based on evidence of active exploitation". It was listed with bugs in Cisco RV routers, Hitachi Vantara Pentaho and Progress WhatsUp Gold. The KEV entry classes it as improper resource shutdown (CWE-404), set a March 24 deadline and marks known ransomware use.

Who is affected#

Every Windows version supported in December 2018: Windows 7 SP1, 8.1 and RT 8.1; Windows 10 1507 through 1809; and Windows Server 2008 SP2 through 2019, including Server 1709 and 1803. Fixes shipped as that month's rollups and cumulative updates, such as KB4471318 for Windows 7, KB4471320 for 8.1 and 2012 R2, and KB4471332 for Windows 10 1809 and Server 2019. Any later update includes the fix.

Do you really need to act?#

Only if you run Windows that has not been patched since 2018. CISA did not say which campaign triggered the listing. The clearest public evidence is older. In February 2023, AhnLab's ASEC described Dalbit (m00nlight), a Chinese group with more than 50 confirmed attack attempts on Korean companies since 2022. Dalbit broke into web, Exchange and SQL servers, often through upload flaws or SQL Server's xp_cmdshell, and dropped web shells. To escalate, it used Potato tools and public GitHub exploits "(CVE-2018-8639, CVE-2019-1458)". It then moved laterally and in some cases locked drives with BitLocker and demanded a ransom. That fits KEV's ransomware flag, though CISA has not confirmed the link. The Hacker News drew the same connection when the KEV entry was added. Microsoft Defender has a detection for this exploit, Exploit:Win64/CVE-2018-8639!MTB, published in June 2019.

So the realistic target is a forgotten server: an old IIS or SQL host that stopped getting updates. Those systems usually have other, newer holes. Windows Server 2012 and 2012 R2 lost their last paid security updates on October 13, 2026.

What to do now#

1. List hosts by last update date, for example Get-HotFix | Sort-Object InstalledOn | Select -Last 1 on each machine, or your patch tool's report.
2. Update anything missing the December 2018 fixes. If the OS is out of support, isolate the host and plan its replacement.
3. Take legacy IIS and SQL Server hosts off the internet and disable xp_cmdshell where it is not needed.
4. Hunt on any legacy server that was exposed while unpatched.

How to tell if you were hit#

Check Defender for the CVE-2018-8639 exploit detection. The NVD entry gives no indicators, but AhnLab's report does. Look for a new local account named main. Look for Potato tools (BadPotato, JuicyPotato, SweetPotato), FRP or LCX tunnelers such as frpc.ini in %SystemRoot%\temp, and lookups of *.m00nlight.top. Also check for BitLocker suddenly enabled on data drives. Match AhnLab's hash list against EDR data.

Timeline#

• Dec 11, 2018 — Microsoft fixes CVE-2018-8639.
• Jun 11, 2019 — Microsoft publishes a Defender detection for the exploit.
• Feb 13, 2023 — AhnLab reports Dalbit using a public exploit for this CVE.
• Mar 3, 2025 — CISA adds the CVE to KEV.
• Mar 24, 2025 — Federal remediation deadline.

Vulnerability records

• CVE-2018-8639 · KEV 2025-03-03 · An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — December 2018 Security Updates (CVRF data for CVE-2018-8639 with KB numbers and acknowledgment) api.msrc.microsoft.com
2. CVE record — CVE-2018-8639 cve.org
3. NVD — CVE-2018-8639 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2018-8639 cisa.gov
5. CISA — CISA Adds Five Known Exploited Vulnerabilities to Catalog (Mar 3, 2025) cisa.gov
6. AhnLab ASEC — Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign asec.ahnlab.com
7. Microsoft Security Intelligence — Exploit:Win64/CVE-2018-8639!MTB microsoft.com
8. Microsoft Learn — Windows Server 2012 and 2012 R2 reaching end of support learn.microsoft.com

Coverage and analysis

1. The Hacker News — Cisco, Hitachi, Microsoft, and Progress Flaws Actively Exploited thehackernews.com