# CVE-1999-0496: Microsoft Windows NT privilege escalation in NtOpenProcessToken

Source: https://junglewise.ai/threats/cve-1999-0496-microsoft-windows-nt-privilege-escalation-in-ntopenprocesstoken  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1997-01-01. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0496 · Severity: high · CVSS 7.2 · Published 1997-01-01

A vulnerability in Windows NT 4.0 allows a standard user to bypass security checks and gain full administrative control over the operating system. By exploiting a flaw in how the system handles process tokens, an attacker can elevate their privileges, potentially leading to unauthorized access to sensitive data, system-wide configuration changes, or the installation of malicious software. This issue, historically known as 'GetAdmin', represents a complete compromise of the local system's security model.

Technologies: [Microsoft Windows Nt](https://junglewise.ai/threats/technologies/windows-nt). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-1999-0496 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0496 being exploited in the wild.

**How severe is CVE-1999-0496?** High severity, with a CVSS score of 7.2, published 1 January 1997.

**Which products and versions are affected?** Microsoft Windows NT 4.0.

**Is there a fix for CVE-1999-0496?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0496 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-0496?** Check whether you run Microsoft Windows Nt. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability, known as 'GetAdmin', is a privilege escalation flaw within the Windows NT 4.0 kernel. It occurs because the NtOpenProcessToken system call can be manipulated to succeed regardless of the calling user's actual permissions. A local attacker with standard user access can exploit this root cause to obtain a token with administrative privileges. This allows for a complete bypass of the operating system's access control mechanisms (CWE-264). The attack requires local access to the system but no special user interaction or prior administrative rights. Microsoft addressed this issue in legacy service packs for Windows NT 4.0.

## Affected products

- Microsoft Windows NT 4.0

## Timeline

- 1997-01-01: disclosed: Initial publication date in NVD record

## References

- [http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ146965](http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ146965)

## Related threats

- [Microsoft Windows NT OS Kernel privilege escalation via integer underflow](https://junglewise.ai/threats/cve-2026-42980-microsoft-windows-nt-os-kernel-privilege-escalation-via-integer)
- [Microsoft Windows NT OS Kernel privilege escalation via integer underflow](https://junglewise.ai/threats/cve-2026-42916-microsoft-windows-nt-os-kernel-privilege-escalation-via-integer)
- [Microsoft Windows NT denial of service in SMB logon request](https://junglewise.ai/threats/cve-1999-0225-microsoft-windows-nt-denial-of-service-in-smb-logon-request)
- [Microsoft Windows TCP/IP stack denial of service in IP fragmentation](https://junglewise.ai/threats/cve-1999-0258-microsoft-windows-tcp-ip-stack-denial-of-service-in-ip)
- [War FTP buffer overflow allows remote command execution](https://junglewise.ai/threats/cve-1999-0256-war-ftp-buffer-overflow-allows-remote-command-execution)