Read the docs
TI-2018-06248 Aliases CVE-2018-8599GHSA-v453-rppj-85f4

An elevation of privilege vulnerability exists when the Diagnostics Hub Standard…

Priority LOW 36CWE-273Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file operations, aka "Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability." This affects Microsoft Visual Studio, Windows Server 2019, Windows Server 2016, Windows 10, Windows 10 Servers.

Why it matters now

EPSS 0.0099 62nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Visual Studio2015 Update 3; 2017; 2017 version 15.9—No fix listedCNA
MicrosoftWindows Server 2019(Server Core installation)—No fix listedCNA
MicrosoftWindows Server 2016(Server Core installation)—No fix listedCNA
MicrosoftWindows 1032-bit Systems; Version 1607 for 32-bit Systems; Version 1607 for x64-based Systems; Version 1703 for 32-bit Systems; Version 1703 for x64-based Systems; Version 1709 for 32-bit Systems; Version 1709 for ARM64-based Systems; Version 1709 for x64-based Systems; Version 1803 for 32-bit Systems; Version 1803 for ARM64-based Systems; Version 1803 for x64-based Systems; Version 1809 for 32-bit Systems; Version 1809 for ARM64-based Systems; Version 1809 for x64-based Systems; x64-based Systems—No fix listedCNA
MicrosoftWindows 10 Serversversion 1709 (Server Core Installation); version 1803 (Server Core Installation)—No fix listedCNA
  • Microsoft Visual Studio VendorMicrosoft Affected 2015 Update 3; 2017; 2017 version 15.9 Fixed in — No fix listed CNA
  • Windows Server 2019 VendorMicrosoft Affected (Server Core installation) Fixed in — No fix listed CNA
  • Windows Server 2016 VendorMicrosoft Affected (Server Core installation) Fixed in — No fix listed CNA
  • Windows 10 VendorMicrosoft Affected 32-bit Systems; Version 1607 for 32-bit Systems; Version 1607 for x64-based Systems; Version 1703 for 32-bit Systems; Version 1703 for x64-based Systems; Version 1709 for 32-bit Systems; Version 1709 for ARM64-based Systems; Version 1709 for x64-based Systems; Version 1803 for 32-bit Systems; Version 1803 for ARM64-based Systems; Version 1803 for x64-based Systems; Version 1809 for 32-bit Systems; Version 1809 for ARM64-based Systems; Version 1809 for x64-based Systems; x64-based Systems Fixed in — No fix listed CNA
  • Windows 10 Servers VendorMicrosoft Affected version 1709 (Server Core Installation); version 1803 (Server Core Installation) Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:visual_studio:2015:update3:*:*:*:*:*:*2015 update3VulnerableMicrosoft
cpe:2.3:a:microsoft:visual_studio_2017:15.9:*:*:*:*:*:*:*15.9VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*1607VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*1703VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*1709VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*1803VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*1809VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:1709:*:*:*:*:*:*:*1709VulnerableMicrosoft
  • cpe:2.3:a:microsoft:visual_studio:2015:update3:*:*:*:*:*:* Versions 2015 update3 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:visual_studio_2017:15.9:*:*:*:*:*:*:* Versions 15.9 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* Versions 1607 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* Versions 1703 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* Versions 1709 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:* Versions 1803 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* Versions 1809 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:1709:*:*:*:*:*:*:* Versions 1709 Vulnerable ·Microsoft
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:*1803VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:* Versions 1803 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-8599
  2. 2026-10-03 Alias added: GHSA-v453-rppj-85f4

References

Patch 1

  • TI-2022-16266 Visual Studio Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2008-03546 Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69… CVSS 2.0HIGH 9.3
  • TI-2009-02381 The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio… CVSS 3.1HIGH 8.8
  • TI-2009-00858 The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio… CVSS 3.1HIGH 8.8
  • TI-2009-02389 Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2… CVSS 2.0HIGH 9.3
  • TI-2009-02388 Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3… CVSS 2.0HIGH 9.3
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences