CVE-2024-38239 - Windows Kerberos Elevation of Privilege Vulnerability

Back Back to CVE browser

HIGH

Windows Kerberos Elevation of Privilege Vulnerability

Published Sep 10, 2024

7.2

HIGH

CVSS 3.1

EPSS 1.75%

Description

Windows Kerberos Elevation of Privilege Vulnerability

Affected products

Vendor Microsoft Product Windows 10 Version 1507 Default
unknown
Affected
- ≥ 10.0.0, < 10.0.10240.20766
Vendor Microsoft Product Windows 10 Version 1607 Default
unknown
Affected
- ≥ 10.0.0, < 10.0.14393.7336
Vendor Microsoft Product Windows 10 Version 1809 Default
unknown
Affected
- ≥ 10.0.0, < 10.0.17763.6293
Vendor Microsoft Product Windows 10 Version 21H2 Default
unknown
Affected
- ≥ 10.0.0, < 10.0.19044.4894
Vendor Microsoft Product Windows 10 Version 22H2 Default
unknown
Affected
- ≥ 10.0.0, < 10.0.19045.4894
Vendor Microsoft Product Windows 11 Version 23H2 Default
unknown
Affected
- ≥ 10.0.0, < 10.0.22631.4169
Vendor Microsoft Product Windows 11 Version 24H2 Default
unknown
Affected
- ≥ 10.0.0, < 10.0.26100.1742
Vendor Microsoft Product Windows 11 version 21H2 Default
unknown
Affected
- ≥ 10.0.0, < 10.0.22000.3197
Vendor Microsoft Product Windows 11 version 22H2 Default
unknown
Affected
- ≥ 10.0.0, < 10.0.22621.4169
Vendor Microsoft Product Windows 11 version 22H3 Default
unknown
Affected
- ≥ 10.0.0, < 10.0.22631.4169
Vendor Microsoft Product Windows Server 2008 Service Pack 2 Default
unknown
Affected
- ≥ 6.0.0, < 6.0.6003.22870
Vendor Microsoft Product Windows Server 2008 R2 Service Pack 1 Default
unknown
Affected
- ≥ 6.1.0, < 6.1.7601.27320
Vendor Microsoft Product Windows Server 2008 R2 Service Pack 1 (Server Core installation) Default
unknown
Affected
- ≥ 6.0.0, < 6.1.7601.27320
Vendor Microsoft Product Windows Server 2008 Service Pack 2 Default
unknown
Affected
- ≥ 6.0.0, < 6.0.6003.22870
Vendor Microsoft Product Windows Server 2008 Service Pack 2 (Server Core installation) Default
unknown
Affected
- ≥ 6.0.0, < 6.0.6003.22870
Vendor Microsoft Product Windows Server 2012 Default
unknown
Affected
- ≥ 6.2.0, < 6.2.9200.25073
Vendor Microsoft Product Windows Server 2012 (Server Core installation) Default
unknown
Affected
- ≥ 6.2.0, < 6.2.9200.25073
Vendor Microsoft Product Windows Server 2012 R2 Default
unknown
Affected
- ≥ 6.3.0, < 6.3.9600.22175
Vendor Microsoft Product Windows Server 2012 R2 (Server Core installation) Default
unknown
Affected
- ≥ 6.3.0, < 6.3.9600.22175
Vendor Microsoft Product Windows Server 2016 Default
unknown
Affected
- ≥ 10.0.0, < 10.0.14393.7336
Vendor Microsoft Product Windows Server 2016 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.0, < 10.0.14393.7336
Vendor Microsoft Product Windows Server 2019 Default
unknown
Affected
- ≥ 10.0.0, < 10.0.17763.6293
Vendor Microsoft Product Windows Server 2019 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.0, < 10.0.17763.6293
Vendor Microsoft Product Windows Server 2022 Default
unknown
Affected
- ≥ 10.0.0, < 10.0.20348.2695
- ≥ 10.0.0, < 10.0.20348.2700
Vendor Microsoft Product Windows Server 2022, 23H2 Edition (Server Core installation) Default
unknown
Affected
- ≥ 10.0.0, < 10.0.25398.1128

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Microsoft	Windows 10 Version 1507	unknown	Affected ≥ 10.0.0, < 10.0.10240.20766
Microsoft	Windows 10 Version 1607	unknown	Affected ≥ 10.0.0, < 10.0.14393.7336
Microsoft	Windows 10 Version 1809	unknown	Affected ≥ 10.0.0, < 10.0.17763.6293
Microsoft	Windows 10 Version 21H2	unknown	Affected ≥ 10.0.0, < 10.0.19044.4894
Microsoft	Windows 10 Version 22H2	unknown	Affected ≥ 10.0.0, < 10.0.19045.4894
Microsoft	Windows 11 Version 23H2	unknown	Affected ≥ 10.0.0, < 10.0.22631.4169
Microsoft	Windows 11 Version 24H2	unknown	Affected ≥ 10.0.0, < 10.0.26100.1742
Microsoft	Windows 11 version 21H2	unknown	Affected ≥ 10.0.0, < 10.0.22000.3197
Microsoft	Windows 11 version 22H2	unknown	Affected ≥ 10.0.0, < 10.0.22621.4169
Microsoft	Windows 11 version 22H3	unknown	Affected ≥ 10.0.0, < 10.0.22631.4169
Microsoft	Windows Server 2008 Service Pack 2	unknown	Affected ≥ 6.0.0, < 6.0.6003.22870
Microsoft	Windows Server 2008 R2 Service Pack 1	unknown	Affected ≥ 6.1.0, < 6.1.7601.27320
Microsoft	Windows Server 2008 R2 Service Pack 1 (Server Core installation)	unknown	Affected ≥ 6.0.0, < 6.1.7601.27320
Microsoft	Windows Server 2008 Service Pack 2	unknown	Affected ≥ 6.0.0, < 6.0.6003.22870
Microsoft	Windows Server 2008 Service Pack 2 (Server Core installation)	unknown	Affected ≥ 6.0.0, < 6.0.6003.22870
Microsoft	Windows Server 2012	unknown	Affected ≥ 6.2.0, < 6.2.9200.25073
Microsoft	Windows Server 2012 (Server Core installation)	unknown	Affected ≥ 6.2.0, < 6.2.9200.25073
Microsoft	Windows Server 2012 R2	unknown	Affected ≥ 6.3.0, < 6.3.9600.22175
Microsoft	Windows Server 2012 R2 (Server Core installation)	unknown	Affected ≥ 6.3.0, < 6.3.9600.22175
Microsoft	Windows Server 2016	unknown	Affected ≥ 10.0.0, < 10.0.14393.7336
Microsoft	Windows Server 2016 (Server Core installation)	unknown	Affected ≥ 10.0.0, < 10.0.14393.7336
Microsoft	Windows Server 2019	unknown	Affected ≥ 10.0.0, < 10.0.17763.6293
Microsoft	Windows Server 2019 (Server Core installation)	unknown	Affected ≥ 10.0.0, < 10.0.17763.6293
Microsoft	Windows Server 2022	unknown	Affected ≥ 10.0.0, < 10.0.20348.2695 ≥ 10.0.0, < 10.0.20348.2700
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	unknown	Affected ≥ 10.0.0, < 10.0.25398.1128

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-1390

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-37205
Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38239
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-37205		Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38239		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Sep 10, 2024

Updated Aug 10, 2026

Reserved Jun 11, 2024

Link CVE-2024-38239

CISA Vulnrichment

Updated Sep 10, 2024

NVD

Status Analyzed

Modified Aug 10, 2026

Link CVE-2024-38239

Red Hat

No data

ENISA EUVD

Assigner microsoft

Published Sep 10, 2024

Updated Aug 10, 2026

Link EUVD-2024-37205

GitHub

No data