CVE-2024-38080
Microsoft Windows Hyper-V Privilege Escalation Vulnerability
Description
CVE-2024-38080 is a high-severity elevation of privilege vulnerability in Microsoft Windows Hyper-V, affecting Windows 11 (versions 21H2, 22H2, 23H2) and Windows Server 2022. A locally authenticated attacker with low privileges can exploit this flaw to gain SYSTEM-level privileges on the host operating system. With a CVSS v3.1 score of 7.8, this vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of July 30, 2024. Its EPSS score of 13.97% at the 94.2nd percentile confirms significant real-world exploitation activity, making it a critical patching priority for any environment running Hyper-V.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 11 21h2 | < 10.0.22000.3079 |
| microsoft | windows 11 22h2 | < 10.0.22621.3880 |
| microsoft | windows 11 23h2 | < 10.0.22631.3880 |
| microsoft | windows server 2022 | < 10.0.20348.2582 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1009 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38080(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38080(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2024-38080. The vulnerability resides in the Windows Hyper-V virtualization stack, where a flaw allows a locally authenticated user to escalate privileges to SYSTEM. Although the exact technical root cause has not been publicly disclosed by Microsoft, elevation of privilege vulnerabilities in hypervisors typically stem from improper validation of requests between the guest and host operating systems, or insufficient access controls within the virtualization boundary.
Impact Analysis
CVE-2024-38080 allows a local attacker with low-level privileges to achieve full SYSTEM-level access on the affected Windows host. The CVSS vector breaks down as follows: Local access (AV:L) means the attacker must already have some form of local or adjacent access to the system, either through an authenticated session or by chaining with another vulnerability. Low attack complexity (AC:L) indicates that exploitation is straightforward once access is obtained. Low privileges required (PR:L) confirms that a standard user account is sufficient to trigger the flaw. Confidentiality, Integrity, and Availability are all rated High, meaning a successful exploit grants the attacker complete control over the system, including the ability to read all data, modify system configurations, install persistent backdoor malware, and disrupt service availability. In enterprise environments where Hyper-V hosts manage multiple virtual machines, compromising the host through this vulnerability could cascade into full infrastructure takeover. The EPSS score of 13.97% at the 94.2nd percentile places this vulnerability well above the exploitation threshold for most organizations. The ransomware association is currently listed as unknown, but any privilege escalation to SYSTEM is a critical enabler for ransomware deployment.
Exploit Maturity
CVE-2024-38080 has confirmed active exploitation in the wild. CISA added it to the Known Exploited Vulnerabilities catalog, mandating federal agencies to remediate by July 30, 2024. The EPSS score of 13.97% at the 94.2nd percentile places this vulnerability in the top 6% of all CVEs by exploitation probability, reflecting widespread and ongoing targeting. Microsoft released a patch as part of the July 2024 Patch Tuesday update cycle, documented in the Microsoft Security Response Center advisory. While specific public exploit code has not been widely circulated, the confirmed in-the-wild exploitation and the relative simplicity of the attack (local, low complexity, low privileges) suggest that threat actors have developed reliable exploits. Ransomware association is currently unknown, but privilege escalation to SYSTEM is a prerequisite step in nearly all ransomware kill chains.
Remediation
-
Apply the July 2024 Microsoft security update for all affected systems immediately. The patch is available through Windows Update, WSUS, and the Microsoft Update Catalog. Refer to the Microsoft Security Response Center advisory for specific KB article numbers for each affected version.
-
Prioritize Hyper-V hosts in your patching schedule as these systems typically manage multiple virtual machines and represent high-value targets. A compromised Hyper-V host can lead to lateral movement across all hosted virtual machines.
-
Verify patch deployment across all affected versions including Windows 11 21H2 (build < 10.0.22000.3079), Windows 11 22H2 (build < 10.0.22621.3880), Windows 11 23H2 (build < 10.0.22631.3880), Windows Server 2022 (build < 10.0.20348.2582), and Windows Server 2022 23H2 (build < 10.0.25398.1009).
-
Restrict local access to Hyper-V hosts by enforcing least-privilege access policies. Limit the number of accounts with local login rights on Hyper-V servers and require multi-factor authentication for privileged access.
-
Monitor for suspicious privilege escalation activity on Hyper-V hosts using endpoint detection and response (EDR) tools. Watch for unexpected SYSTEM-level process creation, unusual Hyper-V worker process behavior, and anomalous local authentication events.
Technical Details
CVE-2024-38080 is an elevation of privilege vulnerability in Windows Hyper-V with a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, resulting in a score of 7.8 (High). The Attack Vector is Local (AV:L), meaning the attacker must have local access to the target system, which is typical for hypervisor-level vulnerabilities where the attacker may be operating from within a guest VM or a local session on the host. Attack Complexity is Low (AC:L), indicating no special conditions or race conditions are required. Privileges Required is Low (PR:L), confirming that any authenticated user account can trigger the vulnerability. User Interaction is None (UI:N), meaning exploitation does not require any action from another user. The Scope is Unchanged (S:U), so the vulnerability affects only the Hyper-V host security context. All three impact metrics are rated High, granting the attacker complete control over confidentiality, integrity, and availability of the target system. The specific technical mechanism involves a flaw in the Hyper-V subsystem that allows a low-privileged user to escalate to SYSTEM. Affected builds include Windows 11 21H2 prior to 10.0.22000.3079, Windows 11 22H2 and 23H2 prior to 10.0.22621.3880 and 10.0.22631.3880 respectively, and Windows Server 2022 prior to 10.0.20348.2582.
Frequently Asked Questions
Is CVE-2024-38080 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2024-38080 and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 30, 2024. The EPSS score of 13.97% at the 94.2nd percentile further confirms significant real-world exploitation activity.
What systems are affected by CVE-2024-38080?
The vulnerability affects Windows 11 versions 21H2, 22H2, and 23H2, as well as Windows Server 2022 and Windows Server 2022 23H2. Only systems with the Hyper-V role enabled are vulnerable. Specific build thresholds are provided in the Microsoft advisory.
Is CVE-2024-38080 used in ransomware attacks?
The ransomware association for CVE-2024-38080 is currently listed as unknown by CISA. However, any elevation of privilege vulnerability that grants SYSTEM access is a critical enabler for ransomware deployment, and organizations should treat this as a high-priority remediation target.
How do I fix CVE-2024-38080?
Apply the July 2024 security update from Microsoft. The patch is available through Windows Update, WSUS, and the Microsoft Update Catalog. See the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38080 for detailed patch guidance.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.