CVE-2024-49138 Exploited in the Wild — Windows 10 Version 1507, Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2025 (Server Core installation)

Vendor	Product	Version	Status
Microsoft	Windows Server 2025 (Server Core installation)	10.0.26100.0 to < 10.0.26100.2605	Affected

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Source	Added
CISA First	2024-12-10 00:00 UTC
CVE	2026-06-09 18:50 UTC

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Virtual Patch

Compensating WAF rules to help reduce exposure to this CVE. Rule content and deployable vendor exports are available with KEVIntel Enterprise.

Not available

KEVIntel does not currently have a virtual patch for this CVE. When available, KEVIntel virtual patches ship as deployable ModSecurity, Cloudflare, and AWS WAF rules.

Enterprise feature. Virtual patch rule content and deployable vendor exports (ModSecurity, Cloudflare, AWS WAF) are available to KEVIntel Enterprise users.

Request Enterprise Access Learn About Virtual Patches

CVSS Scores

CVSS v3.1 7.8 High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2024-12-10 00:00:00 UTC · CISA

Proof of concept available

Recorded 2025-01-15 00:43:37 UTC · GitHub

Weaknesses (CWE)

CWE-122

Heap-based Buffer Overflow

Scanner Integrations

Scanner	Reference	Detected
Nessus	https://www.tenable.com/plugins/nessus/212240	Jun 02, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

MrAle98/CVE-2024-49138-POC

github · Created 2025-01-15 00:43:37 UTC · 248 stars

POC exploit for CVE-2024-49138

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

9 Jun 2026 18:50 UTC about 1 month ago

9 Jun 2026 18:50 UTC · about 1 month ago

KEV confirmed by CVE

Exploitation attested by an external source
2 Jun 2025 09:25 UTC about 1 year ago

2 Jun 2025 09:25 UTC · about 1 year ago

Nessus plugin available

Scanner coverage available
15 Jan 2025 00:43 UTC over 1 year ago

15 Jan 2025 00:43 UTC · over 1 year ago

Public PoC available

Public proof-of-concept code published
10 Dec 2024 17:49 UTC over 1 year ago

10 Dec 2024 17:49 UTC · over 1 year ago

CVE published

Vulnerability disclosed publicly
10 Dec 2024 00:00 UTC over 1 year ago

10 Dec 2024 00:00 UTC · over 1 year ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
11 Oct 2024 20:57 UTC almost 2 years ago

11 Oct 2024 20:57 UTC · almost 2 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2024-49138

{
  "cve_id": "CVE-2024-49138",
  "title": "Windows Common Log File System Driver Elevation of Privilege Vulnerability",
  "affected_vendor": "Microsoft",
  "affected_product": "Windows 10 Version 1507, Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows Server 2008  Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2025 (Server Core installation)",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 7.8,
  "epss_score": 0.25414,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2024-49138

At a Glance

Affected Versions

CVE References

Recommended Actions