{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/windows-11-versions-prior-to-10.0.22000.2777/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_11:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2024-21338"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows 10 (versions prior to 10.0.17763.5458, 10.0.19044.4046, 10.0.19045.4046)","Windows 11 (versions prior to 10.0.22000.2777)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eCVE-2024-21338 is a security vulnerability residing in the Windows Kernel that enables local privilege escalation on Windows 10 and Windows 11 systems. The vulnerability is specifically exploitable when Hypervisor-Protected Code Integrity (HVCI) is enabled, a configuration designed to protect kernel-mode processes. An attacker who has already obtained local administrator privileges can leverage this flaw to perform token manipulation, effectively transitioning to kernel-mode execution. The availability of multiple proof-of-concept exploits on platforms such as Sploitus significantly increases the risk of exploitation. Defenders should prioritize patching vulnerable systems, particularly those operating in environments where administrative access is provided to users or is a common initial compromise vector for attackers.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2024-21338 results in a complete compromise of the host system's security boundary. By escalating from local administrator to kernel-level privileges, an attacker can bypass security features, disable EDR/AV solutions, install rootkits, and maintain persistent access that is highly resistant to detection. This vulnerability affects a wide range of Windows 10 and 11 builds, posing a severe risk to enterprise environments where kernel integrity is a primary defense component.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch all Windows 10 and 11 workstations and servers to the versions addressing CVE-2024-21338 immediately.\u003c/li\u003e\n\u003cli\u003eAudit administrative access across the fleet to identify and restrict users with unnecessary elevated privileges.\u003c/li\u003e\n\u003cli\u003eUtilize EDR telemetry to monitor for suspicious kernel-mode activity or unauthorized attempts to manipulate system process tokens.\u003c/li\u003e\n\u003cli\u003eReview patch status for the specific builds listed in the affected products section.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T10:47:44Z","date_published":"2026-10-14T10:47:44Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-21338/","summary":"CVE-2024-21338 is a local privilege escalation vulnerability in the Windows Kernel affecting systems with Hypervisor-Protected Code Integrity enabled, allowing local administrators to elevate to kernel-level access via token manipulation.","title":"Local Privilege Escalation Vulnerability in Windows Kernel (CVE-2024-21338)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-21338/"}],"language":"en","title":"CraftedSignal Threat Feed - Windows 11 (Versions Prior to 10.0.22000.2777)","version":"https://jsonfeed.org/version/1.1"}