CVE-2024-38080
Exploited in the wild. In CISA KEV since 2024‑07‑09. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- Microsoft Windows 11 version 21H2Affected: ≥ 10.0.0, < 10.0.22000.3079Upgrade to: 10.0.22000.3079Affected: ≥ 10.0.22621.0, < 10.0.22621.3880Upgrade to: 10.0.22621.3880Affected: ≥ 10.0.22631.0, < 10.0.22631.3880Upgrade to: 10.0.22631.3880Stated by: CVE record
- Microsoft Windows Server 2022Affected: ≥ 10.0.20348.0, < 10.0.20348.2582Upgrade to: 10.0.20348.2582Affected: ≥ 10.0.25398.0, < 10.0.25398.1009Upgrade to: 10.0.25398.1009Stated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
Coverage timeline
0 publishersAdded to CISA KEV catalog
Sourced from public security reporting — each date is when it was published, not when it happened.
What it is
From the CVE record
Windows Hyper-V Elevation of Privilege Vulnerability
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Listed as exploited in the wild since 2024-07-09.
US federal agencies must remediate by 2024-07-30.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Public exploits
1 source with a proof of concept or module.
Exploit links, PoCs and Metasploit modules after sign-in- EPSS
7.1% chance of exploitation activity in the next 30 days, which ranks it in the 94th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
- Attention now
Sustained.
Lifecycle
The patch came 129 days before any public exploit.
- OpenVAS check added
- EPSS band changemoderate → low
- Public exploit / PoCsource: github-poc
- Patch availablerecord updated
- Added to CISA KEVpublished, weakness classified, att&ck mapped
Affected products
Technical detail
CVSS 3.1 vector
Open in the CVSS calculatorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Scored 7.8 by NVD.
How it is reached
- Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
- Attack Complexity LowNo special conditions — the attack can be reliably reproduced
- Privileges Required LowRequires basic user-level privileges
- User Interaction NoneNo user interaction needed — fully automated exploitation
Scope
- Scope UnchangedImpact is limited to the vulnerable component itself
Impact if exploited
- Confidentiality HighTotal information disclosure — all data in the component is compromised
- Integrity HighTotal loss of integrity — attacker can modify any data in the component
- Availability HighTotal denial of service — the component is completely unavailable
Weaknesses
ATT&CK techniques
Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.
- Initial AccessT1190Exploit Public-Facing Applicationmedium confidence
Sources
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Microsoft Corp, not every advisory. This one: actively exploited.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI