CVE-2024-21338
published 2024-02-13CVE-2024-21338: Windows Kernel Elevation of Privilege Vulnerability
PriorityP188high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2024-03-25
Exploited in the wild
EPSS
51.87%
98.8th percentile
Windows Kernel Elevation of Privilege Vulnerability
Affected
37 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1809 | < 10.0.17763.5458 | 10.0.17763.5458 |
| microsoft | windows_10_21h2 | < 10.0.19044.4046 | 10.0.19044.4046 |
| microsoft | windows_10_22h2 | < 10.0.19045.4046 | 10.0.19045.4046 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.5458 | 10.0.17763.5458 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.5458 | 10.0.17763.5458 |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19044.4046 | 10.0.19044.4046 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.4046 | 10.0.19045.4046 |
| microsoft | windows_11_21h2 | < 10.0.22000.2777 | 10.0.22000.2777 |
| microsoft | windows_11_22h2 | < 10.0.22621.3155 | 10.0.22621.3155 |
| microsoft | windows_11_23h2 | < 10.0.22631.3155 | 10.0.22631.3155 |
| microsoft | windows_11_version_21h2 | >= 10.0.0 < 10.0.22000.2777 | 10.0.22000.2777 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.3155 | 10.0.22621.3155 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.3155 | 10.0.22631.3155 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.3155 | 10.0.22631.3155 |
| microsoft | windows_server_2019 | < 10.0.17763.5458 | 10.0.17763.5458 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.5458 | 10.0.17763.5458 |
| microsoft | windows_server_2022 | < 10.0.20348.2322 | 10.0.20348.2322 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.2322 | 10.0.20348.2322 |
| microsoft | windows_server_2022_23h2 | <= 10.0.25398.709 | — |
| msrc | windows_10_version_1809_for_32-bit_systems | — | — |
| msrc | windows_10_version_1809_for_arm64-based_systems | — | — |
| msrc | windows_10_version_1809_for_x64-based_systems | — | — |
| msrc | windows_10_version_21h2_for_32-bit_systems | — | — |
| msrc | windows_10_version_21h2_for_arm64-based_systems | — | — |
| msrc | windows_10_version_21h2_for_x64-based_systems | — | — |
Detection & IOCsextracted from sources · hover to see the quote
yara↗
rule signed_driver_64bit { meta: description = "Detects 64-bit signed drivers" author = "Jiri Vinopal @ Check Point Research" condition: uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and uint16(uint32(0x3C) + 0x5c) == 0x0001 and uint16(uint32(0x3C) + 0x18) == 0x020b and }- →Monitor for IOCTL requests targeting the appid.sys kernel driver (Windows AppLocker driver); malicious exploitation involves a specially crafted IOCTL that causes kernel-mode code execution. ↗
- →Alert on processes spawned with SYSTEM privileges from user-level parent processes, especially following interaction with appid.sys. ↗
- →Detect unexpected termination or disabling of security services (AV/EDR) such as AhnLab V3, Windows Defender, CrowdStrike Falcon, and HitmanPro following privilege escalation activity. ↗
- →Hunt for FudModule rootkit activity performing direct kernel object manipulation (DKOM), which is the post-exploitation payload delivered after CVE-2024-21338 exploitation by Lazarus Group. ↗
- →Monitor for attempts to tamper with PPL (Protected Process Light) protected processes or lsass after a privilege escalation event, as kernel access enables PPL bypass and credential dumping. ↗
- →Correlate CVE-2024-21338 exploitation attempts with Lazarus Group TTPs; the group exploited this as a zero-day from at least August 2023 through February 2024 patch. ↗
- →Check driver DACL/SDDL to identify if appid.sys device object is accessible by non-privileged users, which is the prerequisite for exploitation of this vulnerability class. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck7.8HIGH
cisa7.8HIGH
vendor_msrc7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
cisa·2024-03-04·CVSS 7.8
CVE-2024-21338 [HIGH] CWE-822 Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
Vulnerability: Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
Affected: Microsoft Windows
Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338; https://nvd.nist.gov/vuln/detail/CVE-2024-21338
Remediation Due Date: 2024-03-25
Microsoft
Windows Kernel Elevation of Privilege Vulnerability
vendor_msrc·2024-02-13·CVSS 7.8
CVE-2024-21338 [HIGH] CWE-822 Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
FAQ: How could an attacker exploit this vulnerability?
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.
Windows Kernel: Windows Kernel
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:Yes;Latest Software Release:Exploitation Detected;DOS:N/A
Reference: https://catalog.update.microsoft.com/v7/site/Se
GHSA
GHSA-jqrq-gqwg-r8r5: Windows Kernel Elevation of Privilege Vulnerability
ghsa_unreviewed·2024-02-13
CVE-2024-21338 [HIGH] CWE-822 GHSA-jqrq-gqwg-r8r5: Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
VulnCheck
Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
vulncheck·2024·CVSS 7.8
CVE-2024-21338 [HIGH] CWE-822 Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.
Affected: Microsoft Windows
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Feb; https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/; h
No detection rules found.
Exploit-DB
Microsoft Windows 11 - Kernel Privilege Escalation
exploitdb·2025-04-22·CVSS 7.8
CVE-2024-21338 [HIGH] Microsoft Windows 11 - Kernel Privilege Escalation
Microsoft Windows 11 - Kernel Privilege Escalation
---
# Exploit Title: Microsoft Windows 11 - Kernel Privilege Escalation
# Date: 2025-04-16
# Exploit Author: Milad Karimi (Ex3ptionaL)
# Contact: [email protected]
# Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL
# Tested on: Win, Ubuntu
# CVE : CVE-2024-21338
#include "pch.hpp"
#include "poc.hpp"
// This function is used to set the IOCTL buffer depending on the Windows
version
void* c_poc::set_ioctl_buffer(size_t* k_thread_offset, OSVERSIONINFOEXW*
os_info)
{
os_info->dwOSVersionInfoSize = sizeof(*os_info);
// Get the OS version
NTSTATUS status = RtlGetVersion(os_info);
if (!NT_SUCCESS(status)) {
log_err("Failed to get OS version!");
return nullptr;
}
log_debug("Windows version detected: %lu.%lu, build: %lu.",
os_info->dwMa
Exploit-DB
Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation
exploitdb·2024-04-02·CVSS 7.8
CVE-2024-21338 [HIGH] Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation
Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation
---
#############################################
# Exploit Title : Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation
# Exploit Author: E1 Coders
# CVE: CVE-2024-21338
#############################################
require 'msf/core'
class MetasploitModule 'CVE-2024-21338 Exploit',
'Description' => 'This module exploits a vulnerability in FooBar version 1.0. It may lead to remote code execution.',
'Author' => 'You',
'License' => MSF_LICENSE,
'References' => [
['CVE', '2024-21338']
]
)
)
register_options(
[
OptString.new('RHOST', [true, 'The target address', '127.0.0.1']),
OptPort.new('RPORT', [true, 'The target port', 1234])
]
)
end
def check
connect
begin
impacket_artifact(dcerpc_binding('ncacn_ip_tcp'),
Greynoiseio
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
blogs_greynoiseio·2025-02-26·CVSS 9.8
[CRITICAL] GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Qualys
Defense Lessons From the Black Basta Ransomware Playbook
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook
## Table of Contents
Know Your Enemys Playbook
Attackers Move Fast
How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against evolving
Qualys
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
#### Table of Contents
- Know Your Enemys Playbook
- Attackers Move Fast
- How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against ev
Tenable
Microsoft Patch Tuesday 2024 Year in Review
blogs_tenable·2024-12-10
Microsoft Patch Tuesday 2024 Year in Review
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Securelist
Review of supply chain attacks in 2024 and potential disruption scenarios for 2025
blogs_securelist·2024-12-09
Review of supply chain attacks in 2024 and potential disruption scenarios for 2025
Table of Contents
- Overview of 2024’s supply chain disruptions
- Beyond 2024’s supply chain incidents: exploring even greater risk scenarios
Authors
- Alexander Liskin
- Vladimir Kuskov
- Igor Kuznetsov
- Vitaly Kamluk
A faulty update by cybersecurity firm CrowdStrike triggered one of the largest IT outages in history, impacting approximately 8.5 million systems worldwide. This incident serves as a stark reminder of the critical risks posed by global IT disruptions and supply chain weaknesses. With large-scale security crises being one of the most relevant threats worldwide, it’s more important than ever to reflect on past events, assess emerging threats, and, most crucially, explore strategies to prevent future incidents.
As part of Kaspersky Security Bulletin 2024, our “Story of th
Securelist
Story of the Year: global IT outages and supply chain attacks
blogs_securelist·2024-12-09
Story of the Year: global IT outages and supply chain attacks
Table of Contents
Overview of 2024’s supply chain disruptions
CrowdStrike Linux outage
XZ backdoor to bypass SSH authentication
Pager attack in Middle East
JavaScript abuse leading to major corporations’ websites being compromised
Cisco Duo supply chain data breach
“regreSSHion” vulnerability in OpenSSH
Fortinet vulnerabilities
Beyond 2024’s supply chain incidents: exploring even greater risk scenarios
A major AI provider failure
Exploitation of on-device AI tools
Cyberattacks on communications satellites
Physical threats to the internet
Kernel exploitation in Windows and Linux
Last but not least: how the risks associated with supply chains could be mitigated
Authors
Alexander Liskin
Vladimir Kuskov
Igor Kuznetsov
Vitaly Kamluk
A faulty update by cybersecurity firm Cro
Securelist
Advanced threat predictions for 2025
blogs_securelist·2024-11-25
Advanced threat predictions for 2025
Table of Contents
Review of last year’s predictions
The rise of creative exploits for mobile, wearables and smart devices
Building new botnets with consumer and corporate software and appliances
Barriers to kernel-level code execution increasingly evaded (kernel rootkits hot again)
Growth in cyberattacks by state-sponsored actors
Hacktivism in cyber-warfare: the new normal in geopolitical conflicts
Supply chain attacks as a service: operators bulk-buying access
Spear-phishing to expand with accessible generative AI
Emergence of more groups offering hack-for-hire services
MFT systems at the forefront of cyberthreats
APT predictions for 2025
Hacktivist alliances to escalate in 2025
The IoT to become a growing attack vector for APTs in 2025
Increasing supply chain attacks on ope
Securelist
Advanced threat predictions for 2025
blogs_securelist·2024-11-25·CVSS 8.8
[HIGH] Advanced threat predictions for 2025
Table of Contents
- Review of last year’s predictions
- APT predictions for 2025
Authors
- Igor Kuznetsov
- Giampaolo Dedola
- Georgy Kucherin
- Maher Yamout
- Vasily Berdnikov
- Isabel Manjarrez
- Ilya Savelyev
- Joao Godinho
We at Kaspersky’s Global Research and Analysis Team monitor over 900 APT (advanced persistent threat) groups and operations. At the end of each year, we take a step back to assess the most complex and sophisticated attacks that have shaped the threat landscape. These insights enable us to anticipate emerging trends and build a clearer picture of what the APT landscape may look like in the year ahead.
In this article in the KSB series, we review the trends of the past year, reflect on the predictions we made for 2024, and offer insights into what we can expect in
Checkpoint
Breaking Boundaries: Investigating Vulnerable Drivers and Mitigating Risks
blogs_checkpoint·2024-09-30
CVE-2024-21338 Breaking Boundaries: Investigating Vulnerable Drivers and Mitigating Risks
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Breaking Boundaries: Investigating Vulnerable Drivers and Mitigating Risks
Research by: Jiri Vinopal
Have you ever wondered why there are so many vulnerable drivers and what might be caus
Bleepingcomputer
New Mallox ransomware Linux variant based on leaked Kryptina code
blogs_bleepingcomputer·2024-09-23·CVSS 7.8
[HIGH] New Mallox ransomware Linux variant based on leaked Kryptina code
## New Mallox ransomware Linux variant based on leaked Kryptina code
## Bill Toulas
## From Kryptina to Mallox
Kryptina was launched as a low-cost ($500-$800) ransomware-as-a-service (RaaS) platform for targeting Linux systems in late 2023 but failed to gain traction in the cybercrime community.
In February 2024, its purported administrator, using the alias "Corlys," leaked Kryptina's source code for free on hacking forums, which was presumably acquired by random ransomware actors interested in getting their hands on a working Linux variant.
After a Mallox affiliate suffered an operational error and exposed their tools, SentinelLabs discovered that Kryptina had been adopted by the project and its source code was used for building rebranded Mallox payloads.
The initial discovery of th
Sentinelone
Kryptina RaaS | From Unsellable Cast-Off to Enterprise Ransomware
blogs_sentinelone·2024-09-23
Kryptina RaaS | From Unsellable Cast-Off to Enterprise Ransomware
## Executive Summary
- Kryptina evolved from a free tool on public forums to being actively used in enterprise attacks, particularly under the Mallox ransomware family.
- In May 2024, a Mallox affiliate leaked staging server data, revealing that their Linux ransomware was based on a modified version of Kryptina.
- The affiliate made superficial changes to source code and documentation, stripping Kryptina branding but retaining core functionality.
- The adoption of Kryptina by Mallox affiliates exemplifies the commoditization of ransomware tools, complicating malware tracking as affiliates blend different codebases into new variants.
- This original research was presented by the author at LABScon 2024 in Scottsdale, Arizona.
## Background
In February of 2024, SentinelOne posted a write-u
Sentinelone
Kryptina RaaS | From Unsellable Cast-Off to Enterprise Ransomware
blogs_sentinelone·2024-09-23
Kryptina RaaS | From Unsellable Cast-Off to Enterprise Ransomware
## Kryptina RaaS | From Unsellable Cast-Off to Enterprise Ransomware
## Executive Summary
Kryptina evolved from a free tool on public forums to being actively used in enterprise attacks, particularly under the Mallox ransomware family.
In May 2024, a Mallox affiliate leaked staging server data, revealing that their Linux ransomware was based on a modified version of Kryptina.
The affiliate made superficial changes to source code and documentation, stripping Kryptina branding but retaining core functionality.
The adoption of Kryptina by Mallox affiliates exemplifies the commoditization of ransomware tools, complicating malware tracking as affiliates blend different codebases into new variants.
This original research was presented by the author at LABScon 2024 in Scottsdale, Arizona.
Bleepingcomputer
Windows Kernel bug fixed last month exploited as zero-day since August
blogs_bleepingcomputer·2024-03-02·CVSS 7.8
[HIGH] Windows Kernel bug fixed last month exploited as zero-day since August
## Windows Kernel bug fixed last month exploited as zero-day since August
## Sergiu Gatlan
Microsoft explains that successful exploitation enables local attackers to gain SYSTEM privileges in low-complexity attacks that don't require user interaction.
"To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system," Redmond says .
The company patched the vulnerability on February 13 and updated the advisory on Wednesday, February 28, to confirm that CVE-2024-21338 had been exploited in the wild, but it didn't disclose any details regarding the attacks.
## Patched six months after initial report
However, Avast told BleepingCompute
Tenable
Microsoft’s February 2024 Patch Tuesday Addresses 73 CVEs (CVE-2024-21351, CVE-2024-21412)
blogs_tenable·2024-02-13·CVSS 7.6
[HIGH] Microsoft’s February 2024 Patch Tuesday Addresses 73 CVEs (CVE-2024-21351, CVE-2024-21412)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
Microsoft February 2024 Patch Tuesday fixes 2 zero-days, 73 flaws
blogs_bleepingcomputer·2024-02-13·CVSS 7.6
[HIGH] Microsoft February 2024 Patch Tuesday fixes 2 zero-days, 73 flaws
## Microsoft February 2024 Patch Tuesday fixes 2 zero-days, 73 flaws
## Lawrence Abrams
16 Elevation of Privilege Vulnerabilities
3 Security Feature Bypass Vulnerabilities
30 Remote Code Execution Vulnerabilities
5 Information Disclosure Vulnerabilities
9 Denial of Service Vulnerabilities
10 Spoofing Vulnerabilities
The total count of 73 flaws does not include 6 Microsoft Edge flaws fixed on February 8th and 1 Mariner flaw.
To learn more about the non-security updates released today, you can review our dedicated articles on the new Windows 11 KB5034765 cumulative update and the Windows 10 KB5034763 update .
## Two zero-days fixed
This month's Patch Tuesday fixes two actively exploited zero-day vulnerabilities, which Microsoft classifies as a flaw that is publicly disclosed or ac
Qualys
Microsoft and Adobe Patch Tuesday, February 2024 Security Update Review | Qualys
blogs_qualys·2024-02-13
Microsoft and Adobe Patch Tuesday, February 2024 Security Update Review | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for February 2024
- Adobe Patches for February 2024
- Zero-day Vulnerabilities Patched in February Patch Tuesday Edition
- Other Critical Severity Vulnerabilities Patched in February Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- Qualys Monthly Webinar Series
The new Microsoft Patch Tuesday Edition for February 2024 is now live! We invite you to join us to review and discuss the details of these security updates and patches.
## Microsoft Patch Tuesday for February 2024
Microsoft Patch
Qualys
Microsoft and Adobe Patch Tuesday, February 2024 Security Update Review
blogs_qualys·2024-02-13
Microsoft and Adobe Patch Tuesday, February 2024 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for February 2024
Adobe Patches for February 2024
Zero-day Vulnerabilities Patched in February Patch Tuesday Edition
Other Critical Severity Vulnerabilities Patched in February Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
Qualys Monthly Webinar Series
The new Microsoft Patch Tuesday Edition for February 2024 is now live! We invite you to join us to review and discuss the details of these security updates and patches.
## Microsoft Patch Tuesday for February 2024
Microsoft Patch Tuesday’s Fe
Trendmicro
The February 2024 Security Update Review
blogs_trendmicro·2024-02-12·CVSS 7.5
[HIGH] The February 2024 Security Update Review
## The February 2024 Security Update Review
Get the Feburary 2024 security update and review.
By: Dustin Childs 2024/02/12 Read time: ( words)
Save to Folio
It’s the second patch Tuesday of the year, and Adobe and Microsoft have released a fresh crop of security updates just in time to be our Valentine. Take a break from your other activities and join us as we review the details of their latest advisories. For those interested in the Microsoft 0-day discovered by the ZDI Threat Hunting Team, you can watch this special edition of the Patch Report:
If you’d rather watch the full video recap covering the entire release, you can check out here:
CVE
Title
Severity
CVSS
Public
Exploited
Type
CVE-2024-21412
Internet Shortcut Files Security Feature Bypass Vulnerability
Important
8.
Trendmicro
The February 2024 Security Update Review
blogs_trendmicro·2024-02-12
The February 2024 Security Update Review
# The February 2024 Security Update Review
Get the Feburary 2024 security update and review.
By: Dustin Childs
2024/02/12
Read time: ( words)
Save to Folio
It’s the second patch Tuesday of the year, and Adobe and Microsoft have released a fresh crop of security updates just in time to be our Valentine. Take a break from your other activities and join us as we review the details of their latest advisories. For those interested in the Microsoft 0-day discovered by the ZDI Threat Hunting Team, you can watch this special edition of the Patch Report:
If you’d rather watch the full video recap covering the entire release, you can check out here:
Adobe Patches for February 2024
For February, Adobe released six patches addressing 29 CVEs in Adobe Acrobat and Reader, Commerce, Substance 3D
Trendmicro
The February 2024 Security Update Review
blogs_trendmicro·2024-02-12·CVSS 7.5
[HIGH] The February 2024 Security Update Review
## The February 2024 Security Update Review
Get the Feburary 2024 security update and review.
By: Dustin Childs Feb 12, 2024 Read time: ( words)
Save to Folio
It’s the second patch Tuesday of the year, and Adobe and Microsoft have released a fresh crop of security updates just in time to be our Valentine. Take a break from your other activities and join us as we review the details of their latest advisories. For those interested in the Microsoft 0-day discovered by the ZDI Threat Hunting Team, you can watch this special edition of the Patch Report:
If you’d rather watch the full video recap covering the entire release, you can check out here:
CVE
Title
Severity
CVSS
Public
Exploited
Type
CVE-2024-21412
Internet Shortcut Files Security Feature Bypass Vulnerability
Important
Trendmicro
The February 2024 Security Update Review
blogs_trendmicro·2024-02-12·CVSS 7.5
[HIGH] The February 2024 Security Update Review
## The February 2024 Security Update Review
Get the February 2024 security update and review.
By: Dustin Childs Feb 12, 2024 Read time: ( words)
Save to Folio
It’s the second patch Tuesday of the year, and Adobe and Microsoft have released a fresh crop of security updates just in time to be our Valentine. Take a break from your other activities and join us as we review the details of their latest advisories. For those interested in the Microsoft 0-day discovered by the ZDI Threat Hunting Team, you can watch this special edition of the Patch Report:
If you’d rather watch the full video recap covering the entire release, you can check out here:
CVE
Title
Severity
CVSS
Public
Exploited
Type
CVE-2024-21412
Internet Shortcut Files Security Feature Bypass Vulnerability
Important
Sentinelone
Black Basta
blogs_sentinelone·2022-11-30
Black Basta
How It Works The Singularity XDR Difference
Singularity Marketplace One-Click Integrations to Unlock the Power of XDR
Pricing & Packaging Comparisons and Guidance at a Glance
Purple AI Accelerate SecOps with Generative AI
Singularity Hyperautomation Easily Automate Security Processes
AI-SIEM The AI SIEM for the Autonomous SOC
Singularity Data Lake AI-Powered, Unified Data Lake
Singularity Data Lake for Log Analytics Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
Singularity Endpoint Autonomous Prevention, Detection, and Response
Singularity XDR Native & Open Protection, Detection, and Response
Singularity RemoteOps Forensics Orchestrate Forensics at Scale
Singularity
Threat Intelligence Comprehensive Adversary Intelligence
Singularity Vulnerability Management
Huntress
CVE-2024-21338 Vulnerability: Analysis, Detection, Removal | Huntress
blogs_huntress·CVSS 7.8
CVE-2024-21338 [HIGH] CVE-2024-21338 Vulnerability: Analysis, Detection, Removal | Huntress
## CVE-2024-21338 Vulnerability
Written by: Nadine Rozell
Published: 11/07/25
CVEs are Common Vulnerabilities and Exposures—unique identifiers for publicly known cybersecurity vulnerabilities. CVE-2024-21338 is a serious kernel-level vulnerability that gives attackers a backstage pass to your systems. It’s a nasty one, and because it’s a kernel driver flaw, it opens the door for some major damage. This page breaks down how this vulnerability operates, its potential impact, and the steps you need to take for detection and prevention to keep your environment secure.
## What is CVE-2024-21338 Vulnerability?
CVE-2024-21338 is a critical elevation of privilege (EoP) vulnerability found in a specific Windows kernel driver. Essentially, a bug in the driver allows a low-privileged user to exe
Zscaler
Zscaler found Windows Security Vulnerabilities | 02-13-2024
blogs_zscaler·CVSS 7.8
[HIGH] Zscaler found Windows Security Vulnerabilities | 02-13-2024
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Sentinelone
Black Basta
blogs_sentinelone
Black Basta
# Black Basta Ransomware: In-Depth Analysis, Detection, and Mitigation
## Summary of Black Basta Ransomware
Black Basta first emerged in early 2022. The ransomware family is an evolution of the Hermes/Ryuk/Conti families. Black Basta was heavily advertised in underground cybercrime markets. Black Basta practices double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data. There are Windows and LInux variants of Black Basta ransomware. The group is responsible for hundreds of attacks against global targets of varying sectors.
February 2025 Update: Nearly a year’s worth of Black Basta chat logs have been released on Telegram, providing detailed insight into the groups operational workflow, reconnaissance activities, and specific userID and details o
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338https://packetstorm.news/files/id/190586/https://www.exploit-db.com/exploits/52275https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21338
2024-02-13
Published
2024-03-04
Added to CISA KEV
Exploited in the wild