CVE-2024-21338

This vulnerability lets an attacker who already has a low-privileged account on the machine “step up” into full administrator control. Think of it like having a valid keycard to a back room and being able to unlock the entire building’s main power and filing systems. Once an attacker has that level of control, they can alter or delete files and run any program as an administrator.

This matters if your business runs Windows 10, Windows 11, Windows Server 2019, or Windows Server 2022 on machines where an attacker could get a low-privileged, authenticated foothold (for example, by compromising a user account). The risk is tied to local access: a local authenticated user with low privileges must be able to execute code on the system. The findings indicate it is reachable in the default configuration, so you should assume typical setups are affected unless you have already applied the fixed updates.

This is RED because it is confirmed in CISA’s KEV and was used in ransomware campaigns. Attackers can already exploit it to escalate from a low-privileged local account to full administrator control, which makes recovery harder and increases the chance of full compromise. Patch by the fixed versions immediately for any affected systems.

Confirm whether you’re affected

• Identify the exact OS version/build on each device/server:
  • Windows 10, Windows 11, Windows Server 2019, Windows Server 2022
  • Record the current build number (the “10.0.x.y” style build).
• Compare each build to the fixed versions listed below for your specific Windows line.

Upgrade to the fixed versions

Apply the vendor fixes as follows (pick the matching fixed build for your branch):

• Windows 10
  • Fixed in 10.0.17763.5458 (or)
  • Fixed in 10.0.19044.4046 (or)
  • Fixed in 10.0.19045.4046
• Windows 11
  • Fixed in 10.0.22000.2777 (or)
  • Fixed in 10.0.22621.3155 (or)
  • Fixed in 10.0.22631.3155
• Windows Server 2019
  • Fixed in 10.0.17763.5458
• Windows Server 2022
  • Fixed in 10.0.20348.2322 (or)
  • Fixed in 10.0.25398.709

Timing expectation (KEV)

• CISA remediation due date: 2024-03-25.

If patching is delayed (workarounds)

• Follow Microsoft’s guidance from the update guide for compensating measures.
• In practical terms for this vulnerability, reduce the number of low-privileged local accounts that can execute code and limit local user privileges (least privilege). If you can’t patch immediately, prioritize systems exposed to real user activity and any systems where user credentials might be at risk.

What to monitor after updating

• Verify the system build shows one of the fixed versions.
• Check for signs of post-exploitation activity (unusual admin-level changes, suspicious processes shortly before/around the patch window, or unexpected creation/modification/deletion of files).
• If you manage endpoints centrally (e.g., via management tooling), ensure the patch took effect across the fleet and report any exceptions.

Severity is High (CVSS 7.8). The weakness is a Windows kernel elevation of privilege (CWE-822), where a local authenticated attacker with low privileges can execute code and gain administrator-level control. Key findings indicate: local attack vector, no user interaction required, and “reachable in default config: true.” Public exploits exist (2 known), and the issue is listed in CISA KEV as used in ransomware campaigns (added 2024-03-04), meaning it is treated as actively exploited rather than theoretical. EPSS is high (prediction indicates likely exploitation), but the operationally important point is KEV confirmation. Patch availability exists with fixed builds per Windows 10/11 and Windows Server versions as listed in the patch section.