Vulnerability Report

CVE-2009-0080

Title: Microsoft Windows Server 2008 Auth Bypass

Auth Bypass

Proof Of Concept

PoC Available for CVE-2009-0080

CWE Category CWE-269

Published Date Apr 15, 2009

Modified Date Jun 16, 2026

Exploit Status Available

Score 6.9 CVSS v2.0

Exploit Probability (EPSS)

2.36%

Vulnerability Summary

CVE-2009-0080: The ThreadPool class in Windows Vista Gold and SP1, and Server 2008, does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local users to gain privileges by leveraging incorrect thread ACLs to access the resources of one of the processes, aka "Windows Thread Pool ACL Weakness Vulnerability."

Impacted Vendors

microsoft 2

Reference Links

http://osvdb.org/53668 http://www.securitytracker.com/id?1022044 http://www.us-cert.gov/cas/techalerts/TA09-104A.html http://www.vupen.com/english/advisories/2009/1026 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-012 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6177 http://osvdb.org/53668 http://www.securitytracker.com/id?1022044 http://www.us-cert.gov/cas/techalerts/TA09-104A.html http://www.vupen.com/english/advisories/2009/1026 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-012 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6177

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

6.9

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:L/AC:M/Au:N/C:C/I:C/A:C

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2009-0080 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/32893

View Code

June 16, 2026 MODIFIED

Vulnerability data updated via NVD.

April 09, 2025 MODIFIED

Vulnerability data or affected products updated.

April 15, 2009 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected Stack

No specific products linked.