EXPOSURES › CVE-2024-43451
CVE-2024-43451
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft Windows NTLMv2 hash disclosure via file open enables user impersonation and credential theft.
This vulnerability allows attackers to extract NTLMv2 hashes through file operations, enabling user impersonation and potential lateral movement. DIB organizations must patch immediately to prevent unauthorized access to sensitive systems and maintain FedRAMP/NIST 800-171 compliance.
Shame score — A known vulnerability in a widely-used OS that enables credential theft, though not a zero-day or ransomware-linked exploit.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |