CVE-2024-38080KEV · OVERDUECWE-190

Windows Hyper-V Elevation of Privilege Vulnerability

High · published July 9, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 94.2th percentile for exploit probability.

816
days past CISA
deadline
CVSS v3.1
7.8
EPSS
7%
Percentile
94.2
In the wild
Confirmed
What it is

🚨 A crafty elevation of privilege vulnerability in Windows Hyper-V could let attackers break through your virtual walls! ⚡ Think of it like a guest at a fancy hotel who discovers a hidden backdoor into the staff-only areas. Once they find it, they can access all the exclusive rooms and resources without a keycard! If exploited, an attacker could gain elevated permissions and perform actions that could compromise the entire system, such as installing malicious software or accessing sensitive data. This scenario is not just a minor nuisance; it could lead to severe data breaches and loss of trust.

Put simply

Think of it like a guest at a fancy hotel who discovers a hidden backdoor into the staff-only areas. Once they find it, they can access all the exclusive rooms and resources without a keycard! This vulnerability allows attackers to elevate their privileges within the Hyper-V environment, giving them greater control over virtual machines and potentially the host operating system itself.

What to do

If exploited, an attacker could gain elevated permissions and perform actions that could compromise the entire system, such as installing malicious software or accessing sensitive data. This scenario is not just a minor nuisance; it could lead to severe data breaches and loss of trust. Immediate action is crucial! Apply the latest security updates from Microsoft for Hyper-V and ensure your systems are not exposed to this vulnerability. Regularly review your configurations and monitor for any suspicious activity. You've got this! Stay vigilant, apply those patches, and you'll keep your virtual environment safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.07115 · 94.2th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2024-07-09T17:02Z
KEV added
2024-07-09 · due 2024-07-30
EPSS history
Timeline
  • 09 JUL 17:02Z
    Windows Hyper-V Elevation of Privilege Vulnerability
    cvelistv5
  • 09 JUL 00:00Z
    Added to CISA KEV — remediate by Jul 30
    kev