CVE-2024-30098
published 2024-07-09CVE-2024-30098: Windows Cryptographic Services Security Feature Bypass Vulnerability
PriorityP346high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
1.26%
66.3th percentile
Windows Cryptographic Services Security Feature Bypass Vulnerability
Affected
43 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.20710 | 10.0.10240.20710 |
| microsoft | windows_10_1607 | < 10.0.14393.7159 | 10.0.14393.7159 |
| microsoft | windows_10_1809 | < 10.0.17763.6054 | 10.0.17763.6054 |
| microsoft | windows_10_21h2 | < 10.0.19044.4651 | 10.0.19044.4651 |
| microsoft | windows_10_22h2 | < 10.0.19045.4651 | 10.0.19045.4651 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.21161 | 10.0.10240.21161 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.8519 | 10.0.14393.8519 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.7919 | 10.0.17763.7919 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.6456 | 10.0.19044.6456 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.6456 | 10.0.19045.6456 |
| microsoft | windows_11_21h2 | < 10.0.22000.3079 | 10.0.22000.3079 |
| microsoft | windows_11_22h2 | < 10.0.22621.3880 | 10.0.22621.3880 |
| microsoft | windows_11_23h2 | < 10.0.22631.3880 | 10.0.22631.3880 |
| microsoft | windows_11_version_21h2 | >= 10.0.22000.0 < 10.0.22000.3079 | 10.0.22000.3079 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.6060 | 10.0.22621.6060 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.6060 | 10.0.22631.6060 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.6060 | 10.0.22631.6060 |
| microsoft | windows_11_version_24h2 | >= 10.0.26100.0 < 10.0.26100.6899 | 10.0.26100.6899 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.22824 | 6.3.9600.22824 |
| microsoft | windows_server_2016 | < 10.0.14393.7159 | 10.0.14393.7159 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.8519 | 10.0.14393.8519 |
| microsoft | windows_server_2019 | < 10.0.17763.6054 | 10.0.17763.6054 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.7919 | 10.0.17763.7919 |
| microsoft | windows_server_2022 | < 10.0.20348.2582 | 10.0.20348.2582 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rv2f-gm8c-p34h: Windows Cryptographic Services Security Feature Bypass Vulnerability
ghsa_unreviewed·2024-07-09
CVE-2024-30098 [HIGH] CWE-327 GHSA-rv2f-gm8c-p34h: Windows Cryptographic Services Security Feature Bypass Vulnerability
Windows Cryptographic Services Security Feature Bypass Vulnerability
Microsoft
Windows Cryptographic Services Security Feature Bypass Vulnerability
vendor_msrc·2024-07-09·CVSS 7.5
CVE-2024-30098 [HIGH] CWE-327 Windows Cryptographic Services Security Feature Bypass Vulnerability
Windows Cryptographic Services Security Feature Bypass Vulnerability
FAQ: Are there any further actions I need to take to be protected from this vulnerability?
Yes. The Windows Smart Card infrastructure relies on the Cryptographic Service Provider (CSP) and Key Storage Provider (KSP) to isolate cryptographic operations from the Smart Card implementation. The KSP is part of the Crypto Next Generation (CNG) architecture and is intended to support modern smart cards. In the case of RSA based certificates, the Smart Card Certificate Propagation service automatically overrides the default and uses the CSP instead of the KSP. This limits usage to the cryptography provided by the CSP and does not benefit from the modern cryptography provided by the KSP.
IMPORTANT REMINDER: The DisableCapiOverrid
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Microsoft warns of Windows smart card auth issues after October updates
blogs_bleepingcomputer·2025-10-20·CVSS 7.5
[HIGH] Microsoft warns of Windows smart card auth issues after October updates
## Microsoft warns of Windows smart card auth issues after October updates
## Sergiu Gatlan
They can also see "invalid provider type specified" and "CryptAcquireCertificatePrivateKey error." error messages.
"This issue is linked to a recent Windows security improvement to use KSP (Key Storage Provider) instead of CSP (Cryptographic Service Provider) for RSA-based smart card certificates to improve cryptography," Microsoft said .
"You can detect if your smart card will be affected by this issue if you observe the presence of Event ID 624 in the System event logs for the Smart Card Service prior to installing the October 2025 Windows security update."
As the company explained, this known issues occurs because this month's security updates are automatically enabling by default a security
Qualys
Microsoft and Adobe Patch Tuesday, March 2025 Security Update Review
blogs_qualys·2025-03-11
Microsoft and Adobe Patch Tuesday, March 2025 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for March 2025
Adobe Patches for March 2025
Zero-day Vulnerabilities Patched in March Patch Tuesday Edition
Critical Severity Vulnerabilities Patched in March Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
Rapid Response withPatch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
Risk Reduction via TruRisk Eliminate
Qualys Monthly Webinar Series
March 2025 Patch Tuesday is here, and Microsoft has rolled out critical security updates that address multiple vulnerabilities across its product suite. Here’s a quick breakdown of what you need to know.
## Microsoft Patch Tu
Qualys
Microsoft and Adobe Patch Tuesday, March 2025 Security Update Review | Qualys
blogs_qualys·2025-03-11
Microsoft and Adobe Patch Tuesday, March 2025 Security Update Review | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for March 2025
- Adobe Patches for March 2025
- Zero-day Vulnerabilities Patched in March Patch Tuesday Edition
- Critical Severity Vulnerabilities Patched in March Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
- Rapid Response withPatch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- Risk Reduction via TruRisk Eliminate
- Qualys Monthly Webinar Series
March 2025 Patch Tuesday is here, and Microsoft has rolled out critical security updates that address multiple vulnerabilities across its product suite. Here’s a quick breakdown of what you need to know.
## Micr
Trendmicro
The July 2024 Security Update Review
blogs_trendmicro·2024-07-09
The July 2024 Security Update Review
## The July 2024 Security Update Review
Get the July 2024 security update and review.
By: Dustin Childs 2024/07/09 Read time: ( words)
Save to Folio
We’re just past the halfway point of 2024, and as expected, Microsoft and Adobe have released their regularly scheduled updates. Take a break from your regular activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the entire release, you can check it out here:
Adobe Patches for July 2024
For July, Adobe released three patches addressing seven CVEs in Adobe Premiere Pro, InDesign, and Adobe Bridge. The patch for InDesign is the largest, fixing four Critical-rated CVEs. All four could lead to arbitrary code execution. The fix for Premiere Pro fixes a single CVE
Trendmicro
The July 2024 Security Update Review
blogs_trendmicro·2024-07-09
The July 2024 Security Update Review
# The July 2024 Security Update Review
Get the July 2024 security update and review.
By: Dustin Childs
2024/07/09
Read time: ( words)
Save to Folio
We’re just past the halfway point of 2024, and as expected, Microsoft and Adobe have released their regularly scheduled updates. Take a break from your regular activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the entire release, you can check it out here:
Adobe Patches for July 2024
For July, Adobe released three patches addressing seven CVEs in Adobe Premiere Pro, InDesign, and Adobe Bridge. The patch for InDesign is the largest, fixing four Critical-rated CVEs. All four could lead to arbitrary code execution. The fix for Premiere Pro fixes a single CVE
2024-07-09
Published