HighPublic exploit

WebDAV Elevation of Privilege Vulnerability in Microsoft Windows

IdentifiersCVE-2016-0051CWE-269

CVE-2016-0051 is a local elevation-of-privilege vulnerability in the Microsoft Windows WebDAV client affecting Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511. According to the provided content, the flaw allows a local user to gain elevated privileges via a crafted application. Microsoft refers to this issue as the "WebDAV Elevation of Privilege Vulnerability." The specific vulnerable function or code path is not provided in the supplied material.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a local attacker to elevate privileges on the affected system. In practical terms, this can enable execution of code with higher rights than the original user context, facilitating post-compromise actions such as disabling protections, accessing restricted resources, credential theft, persistence, or further lateral movement. The supplied content specifically notes threat-actor use of this vulnerability on unpatched computers for privilege escalation.

Mitigation

If you can’t patch tonight, do this now.

Until patching is completed, reduce opportunities for local code execution by restricting execution of untrusted applications, limiting user ability to run arbitrary binaries, and enforcing least-privilege for local users. Monitor for suspicious use of public privilege-escalation tooling and anomalous child processes or binaries associated with local exploit execution. Since exploitation is local, hardening endpoints against initial compromise and application execution is the primary interim mitigation. The provided content does not include any WebDAV-specific workaround.

Remediation

Patch, then assume compromise.

Apply the Microsoft security update that addresses CVE-2016-0051 on all affected Windows versions. Because the provided content identifies exploitation on unpatched systems, remediation should prioritize patching exposed and legacy hosts running the listed affected versions. If available in the environment, upgrade to supported Windows releases that include the fix.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).

VALID 1 / 3 TOTALView more in app

CVE-2016-0051MaturityPoCVerified exploit

This repository contains two main proof-of-concept exploits for CVE-2016-0051 (MS16-016), a Windows kernel vulnerability. The structure includes two Visual Studio solutions: 'BSoD' and 'EoP'. - The 'BSoD' project (BSoD/BSoD/Program.cs) is a C# program that sets up a fake WebDAV server on a random local port and attempts to trigger a Blue Screen of Death (system crash) by interacting with the Windows network stack using crafted network shares and file operations. - The 'EoP' project (EoP/EoP/Program.cs) is a more complex C# exploit that also sets up a fake WebDAV server and uses Windows API calls to trigger the vulnerability, but its goal is to escalate privileges to SYSTEM. If successful, it spawns a SYSTEM shell (cmd.exe). The EoP project also includes a 'Shellcode' subproject (C++), which is likely used to generate the payload for the privilege escalation. Both exploits are local (require code execution on the target) and target unpatched versions of Windows 7 SP1 x86 (for EoP) and Windows 10 x64 (for BSoD). The exploits use the loopback address (127.0.0.1) and dynamically chosen ports to set up the fake WebDAV server and network shares. The README provides context, references, and a timeline for the vulnerability's discovery and disclosure. Overall, this repository provides operational proof-of-concept code for both denial-of-service (BSoD) and privilege escalation (EoP) attacks against vulnerable Windows systems.

koczkatamasDisclosed Feb 9, 2016csharpcpplocal

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationWindows 10operating_system

Microsoft CorporationWindows 7operating_system

Microsoft CorporationWindows 8.1operating_system

Microsoft CorporationWindows Rt 8.1operating_system

Microsoft CorporationWindows Server 2008operating_system

Microsoft CorporationWindows Server 2012operating_system

Microsoft CorporationWindows Vistaoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

mitre attack websiteNews

May 26, 2020

Whitefly, Group G0107 | MITRE ATT&CK®

A Windows privilege escalation vulnerability that Whitefly exploited on unpatched systems.

mitre attackNews

Jan 24, 2026

Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®

Windows privilege escalation vulnerability exploited using an open-source tool by Whitefly.

mitre attackNews

Mar 18, 2026

Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®

Known Windows privilege escalation vulnerability exploited using an open-source tool by Whitefly.

mitre attackNews

Mar 18, 2026

Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®

Windows privilege escalation vulnerability exploited by Whitefly using an open-source tool on unpatched systems.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence3

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2016-0051

NVD

nvd.nist.gov/vuln/detail/CVE-2016-0051

MITRE CWE · CWE-269

cwe.mitre.org

securitytracker.com

securitytracker.com/id/1034980

docs.microsoft.com

docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-016

exploit-db.com

exploit-db.com/exploits/39432

exploit-db.com

exploit-db.com/exploits/39788

exploit-db.com

exploit-db.com/exploits/40085