EXPOSURES › CVE-2024-21338
CVE-2024-21338
CRITICAL ⌖ ON CISA KEV · EXPLOITEDA local privilege escalation flaw in Windows appid.sys was actively exploited in the wild to enable ransomware attacks.
An exposed IOCTL with insufficient access control in appid.sys allowed local attackers to escalate privileges, a vulnerability that was actively exploited in the wild and linked to ransomware campaigns. DIB organizations must ensure all Windows systems are patched immediately, as this unpatched, exploited-in-wild flaw demonstrates the severe risk of relying on known but unpatched vulnerabilities in critical infrastructure.
Shame score — The vulnerability was actively exploited in the wild and linked to ransomware, indicating a severe, avoidable failure in patch management and threat detection.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |