EXPOSURES › CVE-2024-38112
CVE-2024-38112
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft Windows MSHTML platform spoofing vulnerability (CVE-2024-38112) actively exploited in the wild.
This high-impact spoofing flaw in the Windows MSHTML platform allows attackers to bypass security controls and compromise confidentiality, integrity, and availability. DIB organizations must immediately patch affected systems to prevent unauthorized access and maintain FedRAMP/NIST 800-171 compliance.
Shame score — While actively exploited, the vulnerability is a known Microsoft issue with no evidence of vendor negligence or avoidable hardening failures.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |