HighPublic exploit

Windows Task Scheduler Vulnerability

IdentifiersCVE-2010-3338CWE-269

CVE-2010-3338 is a local privilege-escalation vulnerability in Windows Task Scheduler affecting Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7. Task Scheduler improperly determines the security context of scheduled tasks, allowing a local user to gain elevated privileges through a crafted application. The vulnerability has been exploited by Carberp and Stuxnet and may overlap CVE-2010-3888.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a local user to gain privileges beyond their existing security context. The exact resulting privilege level and specific confidentiality, integrity, or availability consequences are not established.

Mitigation

If you can’t patch tonight, do this now.

Because this is a local privilege escalation issue, mitigation focuses on reducing opportunities for local code execution and post-compromise abuse. Limit interactive access for untrusted users, enforce least privilege, restrict the ability to run unapproved applications, and use application control to prevent execution of attacker-supplied binaries. Monitor for anomalous scheduled task creation or modification and suspicious child processes associated with Task Scheduler. Prompt patching remains the primary mitigation.

Remediation

Patch, then assume compromise.

Apply the relevant Microsoft security updates for affected Windows versions that correct Task Scheduler's handling of task security context. Systems running Windows Vista, Windows Server 2008, Windows Server 2008 R2, and Windows 7 should be brought to the vendor-patched level. Standard remediation should also include retiring unsupported operating systems where possible and validating that all scheduled-task-related security fixes have been deployed consistently across the fleet.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

VALID 1 / 2 TOTALView more in app

ms10_092_schelevator.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module: 'ms10_092_schelevator.rb', which exploits CVE-2010-3338, a privilege escalation vulnerability in the Windows Task Scheduler (Task Scheduler 2.0 XML) on Windows Vista, 7, and 2008. The exploit leverages weak CRC32 validation in task files, allowing a local attacker to modify their own scheduled task file and create a CRC32 collision, resulting in arbitrary command execution as SYSTEM. The module requires a Meterpreter session on a vulnerable system and can deliver any compatible Metasploit payload, such as a reverse shell or command execution. The code interacts with the Windows Task Scheduler's task files (typically in C:\Windows\System32\Tasks\) and may drop a payload executable in the user's TEMP directory. The module is weaponized, highly reliable, and leaves artifacts on disk. The repository is a single Ruby file, standard for Metasploit local privilege escalation modules.

Disclosed Sep 13, 2010rubylocal

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationWindows 7operating_system

Microsoft CorporationWindows Server 2008operating_system

Microsoft CorporationWindows Vistaoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®

A Windows vulnerability exploited by Carberp for privilege escalation.

mitre attackNews

Jan 24, 2026

Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®

Windows privilege escalation vulnerability exploited by Carberp.

mitre attackNews

Mar 18, 2026

Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®

Windows privilege escalation vulnerability exploited by Carberp.

mitre attackNews

Mar 18, 2026

Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®

Windows privilege escalation vulnerability exploited by Carberp.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware4

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity