CVE-2016-0128 — The SAM and LSAD protocol implementations in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 do not properly establish an RPC channel, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "Windows SAM and LSAD Downgrade Vulnerability" or "BADLOCK."

Back Back to CVE browser

MEDIUM

The SAM and LSAD protocol implementations in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 do not properly establish an RPC channel, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "Windows SAM and LSAD Downgrade Vulnerability" or "BADLOCK."

Published Apr 12, 2016

6.8

MEDIUM

CVSS 3.1

EPSS 20.88%

Description

The SAM and LSAD protocol implementations in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 do not properly establish an RPC channel, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "Windows SAM and LSAD Downgrade Vulnerability" or "BADLOCK."

Remediation

No remediation recorded yet.

Metrics

20.88% 0.20877

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.20877

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	20.88% (0.20877)	97.49th	v5 (v2026.06.15)
Jun 15, 2026	20.88% (0.20877)	97.23th	v5 (v2026.06.15)
May 21, 2026	77.04% (0.77043)	98.98th	v4 (v2025.03.14)
Jan 11, 2026	60.27% (0.60274)	98.20th	v4 (v2025.03.14)
Dec 18, 2025	40.99% (0.40991)	97.23th	v4 (v2025.03.14)
Jul 16, 2025	34.58% (0.34582)	96.81th	v4 (v2025.03.14)
Mar 17, 2025	16.58% (0.16579)	94.39th	v4 (v2025.03.14)
Dec 12, 2024	1.92% (0.01923)	89.09th	v3 (v2023.03.01)
Mar 7, 2023	2.06% (0.02062)	87.24th	v3 (v2023.03.01)
Mar 6, 2023	10.50% (0.10495)	94.63th	v2 (v2022.01.01)
Feb 14, 2023	10.50% (0.10495)	94.45th	v2 (v2022.01.01)
Apr 1, 2022	9.87% (0.09867)	93.86th	v2 (v2022.01.01)
Feb 4, 2022	9.87% (0.09867)	87.28th	v2 (v2022.01.01)

Weaknesses (1)

CWE-254

References (6)

http://badlock.org/
x_refsource_MISCThird Party Advisory
http://www.securitytracker.com/id/1035534
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://bto.bluecoat.com/security-advisory/sa122
x_refsource_CONFIRMThird Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-047
vendor-advisoryx_refsource_MSPatchVendor Advisory
https://www.kb.cert.org/vuls/id/813296
third-party-advisoryx_refsource_CERT-VNThird Party AdvisoryUS Government Resource
https://www.samba.org/samba/security/CVE-2016-2118.html
x_refsource_MISCVendor Advisory

Link	Providers	Tags
http://badlock.org/		x_refsource_MISCThird Party Advisory
http://www.securitytracker.com/id/1035534		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://bto.bluecoat.com/security-advisory/sa122		x_refsource_CONFIRMThird Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-047		vendor-advisoryx_refsource_MSPatchVendor Advisory
https://www.kb.cert.org/vuls/id/813296		third-party-advisoryx_refsource_CERT-VNThird Party AdvisoryUS Government Resource
https://www.samba.org/samba/security/CVE-2016-2118.html		x_refsource_MISCVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Apr 12, 2016

Updated Aug 5, 2024

Reserved Dec 4, 2015

Link CVE-2016-0128

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2016-0128

Red Hat

Severity n/a

Public date n/a

Links CVE-2016-0128