EXPOSURES › CVE-2024-21351
CVE-2024-21351
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft Windows SmartScreen bypass allows code injection and potential execution, enabling attackers to circumvent a core security feature.
This vulnerability allows attackers to bypass Windows SmartScreen to inject code, potentially leading to code execution and data exposure. For DIB organizations, this undermines the integrity of endpoint security controls and increases the risk of ransomware or data theft if systems are compromised.
Shame score — While the vulnerability is high severity and in KEV, it is a known issue with a patch available, and the vendor is Microsoft, a trusted entity.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |