# CVE-2018-8253: Microsoft Cortana Elevation of Privilege Vulnerability

CVE-2018-8253 is fixed in 4 products on 1 platform, first by KB4343887, released August 14, 2018. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2018-8253
- Priority: Routine
- CVSS: 4.0 (Important)
- EPSS: 0.0193
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Vendor exploitability assessment: N/A
- Published: Aug 14, 2018
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-8253

## Description

<p>An elevation of privilege vulnerability exists when Microsoft Cortana allows arbitrary website browsing on the lockscreen.</p> <p>An attacker who successfully exploited the vulnerability could steal browser stored passwords or log on to websites as another user. To exploit the vulnerability, an attacker would require physical access to the console and the system must have Microsoft Cortana assistance enabled.</p> <p>The security update addresses the vulnerability by preventing Microsoft Cortana from allowing arbitrary website browsing on the lockscreen.</p>

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Microsoft | Windows 10 Version 1607 for 32-bit Systems | 14393.2430 | [KB4343887](https://patchblox.com/security/data/fix/microsoft/kb4343887.md) | Aug 14, 2018 |
| Microsoft | Windows 10 Version 1607 for x64-based Systems | 14393.2430 | [KB4343887](https://patchblox.com/security/data/fix/microsoft/kb4343887.md) | Aug 14, 2018 |
| Microsoft | Windows Server 2016 | 14393.2430 | [KB4343887](https://patchblox.com/security/data/fix/microsoft/kb4343887.md) | Aug 14, 2018 |
| Microsoft | Windows Server 2016 (Server Core installation) | 14393.2430 | [KB4343887](https://patchblox.com/security/data/fix/microsoft/kb4343887.md) | Aug 14, 2018 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo