HighPublic exploitVulnerability

CVE-2016-0051

Windows WebDAV Elevation of Privilege Vulnerability

Published Feb 10, 2016 · Updated 12 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS7.8High · v3

EPSS22.8%98th percentile

CISA KEVNoNot listed

In the wildReported2 exploitation records in Mallory

Vendor: Microsoft Corporation

IdentifiersCVE-2016-0051CWE-269

CVE-2016-0051 is a local privilege-escalation vulnerability in the Microsoft Windows WebDAV client. A local user can gain elevated privileges through a crafted application. Affected versions include Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511. Whitefly has exploited the vulnerability using an open-source tool on unpatched computers. The underlying implementation flaw and vulnerable function are not specified.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a local user to gain elevated privileges on an affected Windows system. The resulting privilege level and specific effects on confidentiality, integrity, or availability are not specified.

Mitigation

If you can’t patch tonight, do this now.

Until patching is completed, reduce opportunities for local code execution by restricting execution of untrusted applications, limiting user ability to run arbitrary binaries, and enforcing least-privilege for local users. Monitor for suspicious use of public privilege-escalation tooling and anomalous child processes or binaries associated with local exploit execution. Since exploitation is local, hardening endpoints against initial compromise and application execution is the primary interim mitigation. The provided content does not include any WebDAV-specific workaround.

Remediation

Patch, then assume compromise.

Apply Microsoft security updates addressing CVE-2016-0051 for the affected Windows release. Specific update identifiers and fixed build numbers are currently not available in the supplied information.

Public exploits

Exploits

2 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit; 2 not yet analyzed, such as Exploit-DB entries.

View more in app →

ms16_016_webdav.rbThis repository contains a single Metasploit module (ms16_016_webdav.rb) that exploits a local privilege escalation vulnerability in the Windows mrxdav.sys driver (CVE-2016-0051, MS16-016). The exploit targets Windows 7 SP1 (32-bit) systems and is not effective against 64-bit systems. The module works by launching a process on the target, then reflectively injecting a DLL containing the attacker's payload, which is executed with SYSTEM privileges. The payload is customizable and typically provides a Meterpreter shell or similar post-exploitation capability. The module requires an existing session on the target and is designed for use within the Metasploit framework. The main fingerprintable endpoints are the vulnerable driver (mrxdav.sys) and the DLL used for injection. The code is mature and operational, providing reliable privilege escalation on supported systems.Disclosed Feb 9, 2016 · Framework: metasploit · ruby · localWeaponized CVE-2016-0051This repository contains two main proof-of-concept exploits for CVE-2016-0051 (MS16-016), a Windows kernel vulnerability. The structure includes two Visual Studio solutions: 'BSoD' and 'EoP'. - The 'BSoD' project (BSoD/BSoD/Program.cs) is a C# program that sets up a fake WebDAV server on a random local port and attempts to trigger a Blue Screen of Death (system crash) by interacting with the Windows network stack using crafted network shares and file operations. - The 'EoP' project (EoP/EoP/Program.cs) is a more complex C# exploit that also sets up a fake WebDAV server and uses Windows API calls to trigger the vulnerability, but its goal is to escalate privileges to SYSTEM. If successful, it spawns a SYSTEM shell (cmd.exe). The EoP project also includes a 'Shellcode' subproject (C++), which is likely used to generate the payload for the privilege escalation. Both exploits are local (require code execution on the target) and target unpatched versions of Windows 7 SP1 x86 (for EoP) and Windows 10 x64 (for BSoD). The exploits use the loopback address (127.0.0.1) and dynamically chosen ports to set up the fake WebDAV server and network shares. The README provides context, references, and a timeline for the vulnerability's discovery and disclosure. Overall, this repository provides operational proof-of-concept code for both denial-of-service (BSoD) and privilege escalation (EoP) attacks against vulnerable Windows systems.koczkatamas · Disclosed Feb 9, 2016 · csharp · cpp · localOperational

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationWindows 10operating_system

Microsoft CorporationWindows 7operating_system

Microsoft CorporationWindows 8.1operating_system

Microsoft CorporationWindows Rt 8.1operating_system

Microsoft CorporationWindows Server 2008operating_system

Microsoft CorporationWindows Server 2012operating_system

Microsoft CorporationWindows Vistaoperating_system

External references

References

MITRE CVEcve.org · CVE-2016-0051 NVDnvd.nist.gov/vuln/detail/CVE-2016-0051 MITRE CWE · CWE-269cwe.mitre.org securitytracker.comsecuritytracker.com/id/1034980 docs.microsoft.comdocs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-016 exploit-db.comexploit-db.com/exploits/39432 exploit-db.comexploit-db.com/exploits/39788 exploit-db.comexploit-db.com/exploits/40085

Activity feed

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

mitre attack websiteNews · Oct 21, 2021Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®A Windows privilege escalation vulnerability exploited by Whitefly using an open-source tool against unpatched computers.Read more ↗mitre attack websiteNews · May 26, 2020Whitefly, Group G0107 | MITRE ATT&CK®A Windows privilege escalation vulnerability that Whitefly exploited on unpatched systems.Read more ↗mitre attackNews · Jan 24, 2026Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®Windows privilege escalation vulnerability exploited using an open-source tool by Whitefly.Read more ↗mitre attackNews · Mar 18, 2026Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®Known Windows privilege escalation vulnerability exploited using an open-source tool by Whitefly.Read more ↗

+1 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidence4Every report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activityCommunity discussion across Reddit, Mastodon, and other social sources.

HighPublic exploitVulnerability

CVE-2016-0051

Windows WebDAV Elevation of Privilege Vulnerability

Published Feb 10, 2016 · Updated 12 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS7.8High · v3

EPSS22.8%98th percentile

CISA KEVNoNot listed

In the wildReported2 exploitation records in Mallory

Vendor: Microsoft Corporation

IdentifiersCVE-2016-0051CWE-269

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Mitigation

If you can’t patch tonight, do this now.

Remediation

Patch, then assume compromise.

Public exploits

Exploits

2 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit; 2 not yet analyzed, such as Exploit-DB entries.

View more in app →

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationWindows 10operating_system

Microsoft CorporationWindows 7operating_system

Microsoft CorporationWindows 8.1operating_system

Microsoft CorporationWindows Rt 8.1operating_system

Microsoft CorporationWindows Server 2008operating_system

Microsoft CorporationWindows Server 2012operating_system

Microsoft CorporationWindows Vistaoperating_system

External references

References

Activity feed

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

+1 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidence4Every report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activityCommunity discussion across Reddit, Mastodon, and other social sources.