CVE-2010-2568

CVE Enrichment

CVSS: 7.8 HIGH
EPSS: 89.62%
EPSS Percentile: 99.79%
CISA KEV: YES — Known Exploited Vulnerability

Description

Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: secure@microsoft.com
Published: 22-Jul-2010 12:43
Last Modified: 17-Jun-2026 06:20
EPSS Date: 2026-10-20

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2022-09-15
Remediation Due: 2022-10-06
Known Ransomware Campaign Use: Unknown
Required Action: Apply updates per vendor instructions.
Notes: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046; https://nvd.nist.gov/vuln/detail/CVE-2010-2568

Affected Products / Versions

microsoft / windows_7
Version / affected range: -
cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*
microsoft / windows_server_2003
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*
microsoft / windows_server_2008
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2008:-:-:*:*:*:*:*:*
microsoft / windows_server_2008
Version / affected range: -
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
microsoft / windows_server_2008
Version / affected range: r2
cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*
microsoft / windows_server_2008
Version / affected range: r2
cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*
microsoft / windows_vista
Version / affected range: -
cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*
microsoft / windows_vista
Version / affected range: -
cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
microsoft / windows_xp
Version / affected range: -
cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*
microsoft / windows_xp
Version / affected range: -
cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

References

Last enrichment sync: 21-Oct-2026 18:58
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

- **Update Legacy Systems and Patches**: Apply security updates that fix known shortcut parsing flaws (e.g., CVE-2010-2568) to eliminate long-standing exploit vectors. Seqrite’s India Cyber Threat Report 2026 Records 265.52 Million Detections

CVE (14)

Malware (10)

People (5)

Threat Actors (10)

MITRE ATT&CK (15)

Vendors (1)

Products (13)

Tools (6)

Industries (10)

Countries (9)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.