CVE-2024-21407
published 2024-03-12CVE-2024-21407: Windows Hyper-V Remote Code Execution Vulnerability
PriorityP185high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
ITWVulnCheck KEVRansomware
Exploited in the wild
EPSS
16.38%
96.6th percentile
Windows Hyper-V Remote Code Execution Vulnerability
Affected
41 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.20526 | 10.0.10240.20526 |
| microsoft | windows_10_1607 | < 10.0.14393.6796 | 10.0.14393.6796 |
| microsoft | windows_10_1809 | < 10.0.17763.5576 | 10.0.17763.5576 |
| microsoft | windows_10_21h2 | < 10.0.19044.4170 | 10.0.19044.4170 |
| microsoft | windows_10_22h2 | < 10.0.19045.4170 | 10.0.19045.4170 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.20526 | 10.0.10240.20526 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.6796 | 10.0.14393.6796 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.5576 | 10.0.17763.5576 |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19044.4170 | 10.0.19044.4170 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.4170 | 10.0.19045.4170 |
| microsoft | windows_11_21h2 | < 10.0.22000.2836 | 10.0.22000.2836 |
| microsoft | windows_11_22h2 | < 10.0.22621.3296 | 10.0.22621.3296 |
| microsoft | windows_11_23h2 | < 10.0.22631.3296 | 10.0.22631.3296 |
| microsoft | windows_11_version_21h2 | >= 10.0.0 < 10.0.22000.2836 | 10.0.22000.2836 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.3296 | 10.0.22621.3296 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.3296 | 10.0.22631.3296 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.3296 | 10.0.22631.3296 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.24768 | 6.2.9200.24768 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.21871 | 6.3.9600.21871 |
| microsoft | windows_server_2016 | < 10.0.14393.6796 | 10.0.14393.6796 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.6796 | 10.0.14393.6796 |
| microsoft | windows_server_2019 | < 10.0.17763.5576 | 10.0.17763.5576 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.5576 | 10.0.17763.5576 |
| microsoft | windows_server_2022 | < 10.0.20348.2333 | 10.0.20348.2333 |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
63140, 63141, 63142, 63144, 63145, 63152, 63153, 63155, 63156, 63161, 63162, 63169, 63170
snort↗
300855, 300856, 300858, 300859, 300860
- →Attacker must be authenticated inside a guest VM and send specially crafted file operation requests to hardware resources on the VM to achieve RCE on the host server — monitor for anomalous VM-to-host hardware resource requests. ↗
- →Exploitation requires prior reconnaissance of the target environment; detect unusual information-gathering activity from within guest VMs before any exploit attempt. ↗
- →The attack vector is guest-to-host: monitor authenticated sessions on Hyper-V guest VMs for unexpected or malformed file operation requests directed at VM hardware resources. ↗
- ·Exploitation is rated 'Less Likely' by Microsoft and requires high attack complexity, including pre-exploitation reconnaissance and authenticated access to a guest VM — not a trivial attack chain. ↗
- ·Talos notes that additional Snort rules may be released at a future date and current rules are subject to change pending additional information. ↗
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck8.1HIGH
vendor_msrc8.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hgr2-6x66-c9q4: Windows Hyper-V Remote Code Execution Vulnerability
ghsa_unreviewed·2024-03-12
CVE-2024-21407 [HIGH] CWE-416 GHSA-hgr2-6x66-c9q4: Windows Hyper-V Remote Code Execution Vulnerability
Windows Hyper-V Remote Code Execution Vulnerability
VulnCheck
Microsoft Windows Use After Free
vulncheck·2024·CVSS 8.1
CVE-2024-21407 [HIGH] Microsoft Windows Use After Free
Microsoft Windows Use After Free
Windows Hyper-V Remote Code Execution Vulnerability
Affected: Microsoft Windows
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://blog.hunterstrategy.net/the-rise-of-interlock-ransomware-group/
Microsoft
Windows Hyper-V Remote Code Execution Vulnerability
vendor_msrc·2024-03-12·CVSS 8.1
CVE-2024-21407 [HIGH] CWE-416 Windows Hyper-V Remote Code Execution Vulnerability
Windows Hyper-V Remote Code Execution Vulnerability
FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to gather information specific to the environment and take additional actions prior to exploitation to prepare the target environment.
FAQ: How would an attacker exploit this vulnerability?
This vulnerability would require an authenticated attacker on a guest VM to send specially crafted file operation requests on the VM to hardware resources on the VM which could result in remote code execution on the host server.
Role: Windows Hyper-V: Role: Windows Hyper-V
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Remote Code Execution
Exploit Stat
No detection rules found.
No public exploits indexed.
Checkpoint
18th March – Threat Intelligence Report
blogs_checkpoint·2024-03-18
CVE-2024-21408 18th March – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 18th March – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 18th March, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Nissan has revealed that the Akira ransomware attack from December 2023 has compromised the personal information of approximately 100K individuals in Australia and New Zealand. The data concerns customers, dealers and some of the employees. The breach resulted in unauthorized access to Nissan’s local IT servers, with up to 10
Bleepingcomputer
Microsoft March 2024 Patch Tuesday fixes 60 flaws, 18 RCE bugs
blogs_bleepingcomputer·2024-03-12·CVSS 5.5
[MEDIUM] Microsoft March 2024 Patch Tuesday fixes 60 flaws, 18 RCE bugs
## Microsoft March 2024 Patch Tuesday fixes 60 flaws, 18 RCE bugs
## Lawrence Abrams
24 Elevation of Privilege Vulnerabilities
3 Security Feature Bypass Vulnerabilities
18 Remote Code Execution Vulnerabilities
6 Information Disclosure Vulnerabilities
6 Denial of Service Vulnerabilities
2 Spoofing Vulnerabilities
The total count of 60 flaws does not include 4 Microsoft Edge flaws fixed on March 7th.
Furthermore, Microsoft did not disclose any zero-days as part of today's Patch Tuesday updates.
To learn more about the non-security updates released today, you can review our dedicated articles on the new Windows 11 KB5035853 update and the Windows 10 KB5035845 update .
## Flaws of interest
This month's Patch Tuesday does not fix any zero-day vulnerabilities but does include some in
Qualys
Microsoft and Adobe Patch Tuesday, March 2024 Security Update Review
blogs_qualys·2024-03-12
Microsoft and Adobe Patch Tuesday, March 2024 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for March 2024
Adobe Patches for March 2024
Other Critical Severity Vulnerabilities Patched in March Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
Qualys Monthly Webinar Series
Welcome to another insightful dive into Microsoft’s Patch Tuesday! This month’s security updates address a significant number of CVEs, underscoring the ongoing battle against digital vulnerabilities. We invite you to join us to review and discuss the details of these security updates and patches.
## Microsoft Patch Tuesday for March 2024
Microsoft Patch Tuesday’s March 2024 edition
Tenable
Microsoft’s March 2024 Patch Tuesday Addresses 59 CVEs (CVE-2024-21407)
blogs_tenable·2024-03-12·CVSS 8.1
[HIGH] Microsoft’s March 2024 Patch Tuesday Addresses 59 CVEs (CVE-2024-21407)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Trendmicro
The March 2024 Security Update Review
blogs_trendmicro·2024-03-12
The March 2024 Security Update Review
# The March 2024 Security Update Review
Get the March 2024 security update and review.
By: Dustin Childs
2024/03/12
Read time: ( words)
Save to Folio
It’s the second Tuesday of the month, and Adobe and Microsoft have released a fresh crop of security updates. Take a break from your other activities and join us as we review the details of their latest advisories. If you’d rather watch the full video recap covering the entire release, you can check it out here:
Adobe Patches for March 2024
For March, Adobe released six patches addressing 56 vulnerabilities in Adobe Experience Manager, Premiere Pro, ColdFusion, Adobe Bridge, Lightroom, and Adobe Animate. Two of these bugs were submitted through the ZDI Program. The largest is the update for Experience Manager, which addresses 44 CVEs.
Talos
Another Patch Tuesday with no zero-days, only two critical vulnerabilities disclosed by Microsoft
blogs_talos·2024-03-12·CVSS 9.8
[CRITICAL] Another Patch Tuesday with no zero-days, only two critical vulnerabilities disclosed by Microsoft
For the second month in 2024, there are no actively exploited vulnerabilities included in this month’s security update from Microsoft.
March’s Patch Tuesday is relatively light, containing 60 vulnerabilities — only two labeled “critical.” Last month’s Patch Tuesday included more than 70 security vulnerabilities affecting Microsoft products, and there were even fewer in January and December, especially when compared to 2023.
Still, both critical vulnerabilities addressed this month are notable because they affect Windows Hyper-V, potentially allowing an adversary to target a host machine from a virtual machine environment.
All other vulnerabilities Microsoft disclosed Tuesday are considered to be of “important” severity.
CVE-2024-21408 is a denial-of-service vulnerability in Windows Hyp
Trendmicro
The March 2024 Security Update Review
blogs_trendmicro·2024-03-12
The March 2024 Security Update Review
## The March 2024 Security Update Review
Get the March 2024 security update and review.
By: Dustin Childs 2024/03/12 Read time: ( words)
Save to Folio
It’s the second Tuesday of the month, and Adobe and Microsoft have released a fresh crop of security updates. Take a break from your other activities and join us as we review the details of their latest advisories. If you’d rather watch the full video recap covering the entire release, you can check it out here:
Adobe Patches for March 2024
For March, Adobe released six patches addressing 56 vulnerabilities in Adobe Experience Manager, Premiere Pro, ColdFusion, Adobe Bridge, Lightroom, and Adobe Animate. Two of these bugs were submitted through the ZDI Program. The largest is the update for Experience Manager , which addresses 44 CVEs.
Qualys
Microsoft and Adobe March 2024 Patch Tuesday Security Fixes | Qualys
blogs_qualys·2024-03-12
Microsoft and Adobe March 2024 Patch Tuesday Security Fixes | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for March 2024
- Adobe Patches for March 2024
- Other Critical Severity Vulnerabilities Patched in March Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
- Qualys Monthly Webinar Series
Welcome to another insightful dive into Microsoft’s Patch Tuesday! This month’s security updates address a significant number of CVEs, underscoring the ongoing battle against digital vulnerabilities. We invite you to join us to review and discuss the details of these security updates and patches.
## Microsoft Patch Tuesday for March 2024
Microsoft Patch Tuesday’s March 20
Talos
Another Patch Tuesday with no zero-days, only two critical vulnerabilities disclosed by Microsoft
blogs_talos·2024-03-12·CVSS 9.8
[CRITICAL] Another Patch Tuesday with no zero-days, only two critical vulnerabilities disclosed by Microsoft
## Another Patch Tuesday with no zero-days, only two critical vulnerabilities disclosed by Microsoft
For the second month in 2024, there are no actively exploited vulnerabilities included in this month’s security update from Microsoft.
March’s Patch Tuesday is relatively light, containing 60 vulnerabilities — only two labeled “critical.” Last month’s Patch Tuesday included more than 70 security vulnerabilities affecting Microsoft products, and there were even fewer in January and December , especially when compared to 2023.
Still, both critical vulnerabilities addressed this month are notable because they affect Windows Hyper-V, potentially allowing an adversary to target a host machine from a virtual machine environment.
All other vulnerabilities Microsoft disclosed Tuesday are consid
Trendmicro
The March 2024 Security Update Review
blogs_trendmicro·2024-03-12
The March 2024 Security Update Review
## The March 2024 Security Update Review
Get the March 2024 security update and review.
By: Dustin Childs Mar 12, 2024 Read time: ( words)
Save to Folio
It’s the second Tuesday of the month, and Adobe and Microsoft have released a fresh crop of security updates. Take a break from your other activities and join us as we review the details of their latest advisories. If you’d rather watch the full video recap covering the entire release, you can check it out here:
Adobe Patches for March 2024
For March, Adobe released six patches addressing 56 vulnerabilities in Adobe Experience Manager, Premiere Pro, ColdFusion, Adobe Bridge, Lightroom, and Adobe Animate. Two of these bugs were submitted through the ZDI Program. The largest is the update for Experience Manager , which addresses 44 CVE
Trendmicro
The March 2024 Security Update Review
blogs_trendmicro·2024-03-12
The March 2024 Security Update Review
## The March 2024 Security Update Review
Get the March 2024 security update and review.
By: Dustin Childs Mar 12, 2024 Read time: ( words)
Save to Folio
It’s the second Tuesday of the month, and Adobe and Microsoft have released a fresh crop of security updates. Take a break from your other activities and join us as we review the details of their latest advisories. If you’d rather watch the full video recap covering the entire release, you can check it out here:
Adobe Patches for March 2024
For March, Adobe released six patches addressing 56 vulnerabilities in Adobe Experience Manager, Premiere Pro, ColdFusion, Adobe Bridge, Lightroom, and Adobe Animate. Two of these bugs were submitted through the ZDI Programme. The largest is the update for Experience Manager , which addresses 44 C
Crowdstrike
March 2024 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] March 2024 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Crowdstrike
March 2024 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] March 2024 Patch Tuesday: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
Crowdstrike
May 2024 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] May 2024 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
2024-03-12
Published
Exploited in the wild