EXPOSURES › CVE-2024-38014
CVE-2024-38014
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft Windows Installer allows attackers to gain SYSTEM privileges via improper privilege management.
This vulnerability enables remote privilege escalation to SYSTEM, allowing attackers to bypass security controls and execute arbitrary code on compromised systems. DIB organizations must patch immediately to prevent unauthorized access to classified or sensitive data, as this directly undermines NIST 800-171 and CMMC security requirements.
Shame score — A critical but standard privilege escalation vulnerability that poses significant risk if exploited, though not inherently negligent.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |