How to Fix CVE-2015-1769: Windows Mount Manager Elevation of Privilege

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Patch immediately. CISA's Known Exploited Vulnerabilities catalog lists this CVE, which means active exploitation has been confirmed. CISA KEV entry added 2022-05-25, federal due date 2022-06-15.

What is CVE-2015-1769?

CVE-2015-1769 is the Mount Manager Elevation of Privilege Vulnerability in Microsoft Windows. The flaw lives in Mount Manager, the kernel-mode component (mountmgr.sys) that detects newly attached volumes and assigns them drive letters and mount points. When a removable device is connected, Mount Manager processes the volume's mount-point data and writes symbolic links into the object namespace. On the affected releases it does not correctly validate those symlinks, so a crafted volume can point a symbolic link at a location it was never meant to reach.

By writing a malicious binary onto a specially formatted USB stick and plugging it into the target machine, an attacker can make Mount Manager drop or overwrite a file as SYSTEM at boot or logon. That turns "I have physical access and a low-privileged session" into "I run arbitrary code with full kernel-level privileges." The official Microsoft SRD write-up describes it as a logical issue exploited via a malicious USB stick. This is a local elevation-of-privilege bug, not a remote one, the CVSS vector confirms it: AV:P (physical attack vector), AC:L (low complexity), PR:L (low privileges required), UI:N (no user interaction), with high confidentiality, integrity, and availability impact, scoring 6.6 (Medium).

The affected surface is broad: Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8 and 8.1; Windows Server 2012 Gold and R2; Windows RT Gold and 8.1; and Windows 10. Because the bug is in a core operating-system driver rather than in an optional application, every one of those SKUs in default configuration is exposed until the August 2015 update is installed.

Why this CVE matters

Microsoft rated this Important and shipped it as part of MS15-085. CISA later added it to the Known Exploited Vulnerabilities catalog on 25 May 2022, which only happens after active, in-the-wild exploitation is confirmed. Symlink-based elevation of privilege is a favorite of post-compromise tooling: an attacker who already has a foothold (a phished standard user, a kiosk session, a stolen laptop, or an insider with USB access) uses CVE-2015-1769 to jump from limited rights to SYSTEM, then disables defenses, dumps credentials, and moves laterally.

The physical attack vector does not make this low-risk. Shared workstations, point-of-sale terminals, kiosks, conference-room PCs, lab machines, and any laptop that can be left unattended are all realistic targets. and "malicious USB device" covers planted drives and USB-impersonating implants, not just an obviously rogue thumb drive. If you run any affected build that has not received the August 2015 rollup, treat unpatched exposure as compromise-likely and review logs accordingly.

Am I affected? Check your patch level

You are affected if the machine runs one of the listed Windows versions and has not installed the August 2015 (MS15-085) update or any later cumulative rollup. There is no service to query and no Linux package, this is a kernel driver shipped with the OS. Confirm the patch state from PowerShell.

# 1. Identify the OS build so you know which MS15-085 package applies
Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber, OSArchitecture

# 2. List installed security updates and look for the August-2015 rollup (or anything newer)
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object HotFixID, InstalledOn -First 20

# 3. Direct check for the MS15-085 updates (KB3071756 umbrella; per-OS KBs include KB3079904)
Get-HotFix -Id KB3071756, KB3079904 -ErrorAction SilentlyContinue

If Get-HotFix returns the MS15-085 KB (or the machine has installed any monthly cumulative update from September 2015 onward, which supersedes it), the fix is already in place. If nothing comes back and the OS is in the affected list, the system is vulnerable.

How to fix CVE-2015-1769

Patched in MS15-085, released 11 August 2015. The fix corrects how Mount Manager validates symbolic links written during volume mounting. There is no separate download to chase and no version string to bump: you install the Windows security update for your operating system, and the patched mountmgr.sys ships inside it. Any monthly cumulative or rollup update released after September 2015 already contains this fix, so a fully patched machine is covered. The steps below cover patching directly, patching offline, and verifying.

Option 1, Install via Windows Update (recommended)

On a supported, internet-connected machine, the simplest path is to let Windows Update pull the rollup that supersedes MS15-085.

# Run from an elevated PowerShell prompt (Run as administrator).
# Trigger a Windows Update scan + install of all pending security updates.
Install-Module -Name PSWindowsUpdate -Force -SkipPublisherCheck -Confirm:$false
Import-Module PSWindowsUpdate

# Install the MS15-085 update specifically (or take the latest cumulative, which includes it)
Get-WindowsUpdate -KBArticleID KB3079904 -AcceptAll
Install-WindowsUpdate -KBArticleID KB3079904 -AcceptAll -AutoReboot

# If you simply want everything current (newer rollups supersede MS15-085):
# Install-WindowsUpdate -AcceptAll -AutoReboot

On a machine without PSWindowsUpdate, the same result comes from the GUI: Settings > Update & Security > Windows Update > Check for updates (Windows 10), or Control Panel > Windows Update (Windows 7 / 8.1 / Server 2008–2012), then install all security updates and reboot.

Option 2. Offline install from the Microsoft Update Catalog

For air-gapped servers, imaging pipelines, or machines managed without WSUS, download the correct package for your exact OS and architecture from the Microsoft Update Catalog (search for MS15-085 or the per-OS KB), then apply the .msu with wusa.exe.

# Example: apply the downloaded MS15-085 package for Windows 8.1 / Server 2012 R2 x64.
# Pick the .msu that matches YOUR OS+architecture from the catalog, do not reuse another build's package.
wusa.exe C:\Patches\Windows8.1-KB3079904-x64.msu /quiet /norestart

# Reboot to load the patched mountmgr.sys driver
shutdown /r /t 60 /c "Rebooting to complete MS15-085 (CVE-2015-1769)"

The driver file is replaced on disk during install, but the running kernel keeps the old mountmgr.sys in memory until restart. A reboot is mandatory: the system is not protected until it has booted on the patched driver.

Option 3, Patch a fleet with WSUS / SCCM

For domain-managed estates, approve the MS15-085 updates (or the superseding cumulative rollup) in WSUS / Microsoft Endpoint Configuration Manager and target the affected collections. Because this CVE is on the CISA KEV list, set the deadline aggressively and force the reboot rather than leaving it to the user. Confirm completion with a compliance report keyed on the KB ID, not just on "deployment succeeded."

If you can't patch immediately

The MS15-085 update is the only durable fix; there is no supported registry switch that disables the Mount Manager bug. Because the exploit requires plugging in a crafted USB device, the realistic interim control is to remove the attacker's physical pathway while you schedule the patch and reboot.

• Block USB mass-storage on at-risk machines. On kiosks, POS terminals, and unattended workstations, disable removable storage via Group Policy: Computer Configuration > Administrative Templates > System > Removable Storage Access > All Removable Storage classes: Deny all access = Enabled. This stops the malicious volume from ever being processed by Mount Manager.
• Physically lock down ports. Disable unused USB ports in firmware/UEFI or use port blockers on shared and public-area machines.
• Restrict who can stand at the console. Since the attack vector is physical (AV:P), tightening physical access to unattended endpoints directly reduces exposure.

These reduce the attack surface but do not remove the flaw. Schedule the patch and reboot as the actual fix.

Verify the fix landed

After installing MS15-085 (or a later rollup) and rebooting, confirm the update is present. There is no Linux package and no service version to read. verification is the KB check plus a vulnerability scan.

# Confirm the MS15-085 KB (or a superseding cumulative update) is installed
Get-HotFix -Id KB3079904, KB3071756 -ErrorAction SilentlyContinue

# Or eyeball the most recent updates and confirm something from Aug 2015 or later landed
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object HotFixID, InstalledOn -First 5

Then run an authenticated vulnerability scan with a current signature set and confirm the scanner no longer flags CVE-2015-1769 on the host. If the machine was a shared or unattended endpoint that sat unpatched, review event logs for unexpected SYSTEM-context process creation, new local accounts, or scheduled tasks created around any period the device was accessible, and rotate any privileged credentials that were used on it.

Frequently asked questions

Which Windows versions are affected, and which update fixes it?

The vulnerable Mount Manager component ships in Windows Vista SP2, Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8 and 8.1, Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10. The fix is Microsoft security update MS15-085, released 11 August 2015. Install the rollup for your OS via Windows Update, any monthly cumulative update from September 2015 onward also contains it.

Can this be exploited remotely or over the network?

No. CVE-2015-1769 has a physical attack vector (CVSS AV:P). An attacker has to connect a specially crafted USB device to the target machine. There is no network-facing service to firewall: a WAF or firewall rule does nothing here. The realistic risk is shared, kiosk, point-of-sale, or unattended endpoints where someone can plug in a USB stick.

Is CVE-2015-1769 actually being exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 25 May 2022 (federal remediation deadline 15 June 2022), which only happens after confirmed in-the-wild exploitation. Treat it as an emergency change on any affected, unpatched machine.

What if I can't patch and reboot right away?

Block USB mass-storage via Group Policy (Removable Storage Access > Deny all access), disable unused USB ports in firmware, and tighten physical access to unattended machines. These shrink the attack surface but do not remove the flaw, installing MS15-085 and rebooting is the only durable fix, and the system is not protected until it has rebooted on the patched mountmgr.sys driver.

References

• Official vendor advisory: http://blogs.technet.com/b/srd/archive/2015/08/11/defending-against-cve-2015-1769-a-logical-issue-exploited-via-a-malicious-usb-stick.aspx
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2015-1769
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV record: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1769
• Additional reference: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-085
• Additional reference: http://www.securitytracker.com/id/1033244
• Additional reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1769

This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV catalog entry on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Other CVEs touching related code paths, worth patching together with this one:

• How to Fix CVE-2015-2502: Out-of-Bounds Write in Microsoft Internet Explorer
• How to Fix CVE-2015-0016: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• How to Fix CVE-2015-2545: Security vulnerability in Microsoft Office
• How to Fix CVE-2015-1770: Access of Uninitialized Pointer in Microsoft Office
• How to Fix CVE-2015-1635: Code injection in Microsoft Windows