{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/windows-server-2016--10.0.14393.7159/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*","cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2024-38077"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows Server 2008 (All versions)","Windows Server 2012 (All versions)","Windows Server 2016 (\u003c 10.0.14393.7159)","Windows Server 2019 (\u003c 10.0.17763.6054)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eCVE-2024-38077 is a critical vulnerability impacting the Microsoft Windows Remote Desktop Licensing (RDL) service. An exploit PoC has been released publicly that utilizes RPC connections on port 135 to determine if a target host is vulnerable. The vulnerability has a CVSS 3.1 score of 9.8. Documentation indicates that patched versions of Windows Server 2016 and 2019 return an \u0026quot;nca_s_fault_access_denied\u0026quot; error during RPC probing, whereas unpatched systems or legacy versions (2008/2012) may behave differently.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated, network-based remote code execution. The EPSS score is 84.2 percent, reflecting a high probability of exploitation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately patch Windows Server 2016 to build 10.0.14393.7159 or later.\u003c/li\u003e\n\u003cli\u003eImmediately patch Windows Server 2019 to build 10.0.17763.6054 or later.\u003c/li\u003e\n\u003cli\u003eRestrict access to RPC port 135 via host-based and network firewalls to only necessary administrative management stations.\u003c/li\u003e\n\u003cli\u003eImplement the hunt leads provided in this brief to identify internal scanning or reconnaissance activity targeting port 135.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T05:01:56Z","date_published":"2026-10-24T05:01:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-38077/","summary":"A publicly available proof-of-concept for CVE-2024-38077 targets the Windows Remote Desktop Licensing (RDL) service over RPC port 135 to identify vulnerable Windows Server systems.","title":"Microsoft Windows RDL Service Remote Code Execution (CVE-2024-38077)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-38077/"}],"language":"en","title":"CraftedSignal Threat Feed - Windows Server 2016 (\u003c 10.0.14393.7159)","version":"https://jsonfeed.org/version/1.1"}