Is CVE-2014-1812 exploitable?

Yes — CVE-2014-1812 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it is confirmed exploited in the wild.

Is CVE-2014-1812 a false positive?

No practitioners have marked CVE-2014-1812 a false positive so far (2 verdicts).

How do I remediate CVE-2014-1812?

See the authoritative references (NVD, vendor advisory) and community field notes on this page for remediation guidance.

CVE-2014-1812

is CVE-2014-1812real, exploitable, or a false positive? Here's the community ground truth.

☆ Watch

High · CVSS 8.8EPSS 64.3%CISA KEVCWE-255

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle distribution of passwords, which allows remote authenticated users to obtain sensitive credential information and consequently gain privileges by leveraging access to the SYSVOL share, as exploited in the wild in May 2014, aka "Group Policy Preferences Password Elevation of Privilege Vulnerability."

References

NVD MITRE CVE.org CISA KEV

Published May 14, 2014

Embed this verdict

Markdown

[![TruePositive verdict](https://www.truepositive.app/cve/CVE-2014-1812/badge.svg)](https://www.truepositive.app/cve/CVE-2014-1812)

HTML

<a href="https://www.truepositive.app/cve/CVE-2014-1812"><img src="https://www.truepositive.app/cve/CVE-2014-1812/badge.svg" alt="TruePositive verdict for CVE-2014-1812"></a>

Live badge — updates automatically as the community verdict changes.

Community ground truth

Community verdict

2 verdicts

Not a real issue

Includes TruePositive's curated baseline from public sources — community verdicts accrue on top.

to add your verdict.

Community real-world severity: Critical (Critical 2) — CVSS base score 8.8

Practitioners rate this higher than its CVSS — treat with extra caution.

Field notes & remediation

Verdicts are the quick signal — notes are the evidence and fixes behind them.

0
Field note · Diego RamírezCurated
Confirmed exploited in the wild — listed in the CISA KEV catalog (added 2021-11-03). Linked to known ransomware campaigns. Treat as real and prioritize patching over triage.