EXPOSURES › CVE-2024-29988
CVE-2024-29988
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft SmartScreen Prompt bypassed Mark of the Web, enabling remote code execution when chained with two other CVEs.
This vulnerability allows attackers to bypass the Mark of the Web (MotW) feature in Microsoft SmartScreen, enabling remote code execution when chained with CVE-2023-38831 and CVE-2024-21412. DIB organizations must patch immediately to prevent ransomware or supply-chain attacks exploiting this chain, as it is actively exploited in the wild.
Shame score — A critical security bypass in a widely deployed Microsoft feature that enables remote code execution when chained with other known vulnerabilities, indicating a failure to maintain robust defense-in-depth.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |