Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2024-21302

Summary: As of July 8, 2025 Microsoft has completed mitigations to address this vulnerability. See KB5042562: Guidance for blocking rollback of virtualization-based security related updates and the Recommended Actions section of this CVE for guidance on how to protect your systems from this vulnerability. An elevation of privilege vulnerability exists in Windows based systems supporting Virtualization Based Security (VBS), including a subset of Azure Virtual Machine SKUS. This vulnerability enables an attacker with administrator privileges to replace current versions of Windows system files with outdated versions. By exploiting this vulnerability, an attacker could reintroduce previously mitigated vulnerabilities, circumvent some features of VBS, and exfiltrate data protected by VBS. Update: July 10, 2025 Microsoft has addressed this vulnerability for Windows 10 1507, Windows 10, version 1607, Windows 10, version 1809, and Windows Server 2016 and Windows Server 2018. This ensures that mitigations are available to protect all supported versions of Windows 10 and Windows 11 from this vulnerability. See the available mitigations and deployment guidelines described in KB5042562: Guidance for blocking rollback of virtualization-based security related updates. Update: August 13, 2024 Microsoft has released the August 2024 security updates that include an opt-in revocation policy mitigation to address this vulnerability. Customers running affected versions of Windows are encouraged to review KB5042562: Guidance for blocking rollback of virtualization-based security related updates to assess if this opt-in policy meets the needs of their environment before implementing this mitigation. There are risks associated with this mitigation that should be understood prior to applying it to your systems. Detailed information about these risks is also available in KB5042562. Details: A security researcher informed Microsoft of an elevation of privilege vulnerability in Windows 10, Windows 11, Windows Server 2016, and higher based systems including Azure Virtual Machines (VM) that support VBS. For more information on Windows versions and VM SKUs supporting VBS, reference: Virtualization-based Security (VBS) | Microsoft Learn. The vulnerability enables an attacker with administrator privileges on the target system to replace current Windows system files with outdated versions. Successful... See more at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21302

CVSS 6.7 · MediumBuzz score 32.5

Buzz score

Why this CVE is surfacing

Buzz score total 32.5

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 23.0 · diversity 9.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
23.0
9 evidence mentions in the snapshot
Diversity score
9.5
4 sources across 1 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
9 source links · newest first
  • More Details Shared on Windows Downgrade Attacks After Microsoft Rolls Out MitigationsSecurityWeek

    Microsoft has rolled out mitigations for recently disclosed downgrade attacks targeting the Windows Update process.

    newswww.securityweek.comOct 28, 2024, 12:48 PM
  • September 2024 Patch Tuesday forecast: Downgrade is the new exploitHelp Net Security

    September 2024 Patch Tuesday is now live: Microsoft fixes 4 exploited zero-days and a code defect that nixed earlier security fixes I asked for a calm August 2024 Patch Tuesday in last month’s forecast article and that came to pass. The updates released were limited to the regular operating systems and all forms of Office applications. Six zero-day vulnerabilities were announced, with five in the operating systems and one in the Office applications. There were … More →

    newswww.helpnetsecurity.comSep 6, 2024, 5:02 AM
  • Microsoft patches bug that could have allowed an attacker to revert your computer back to an older, vulnerable versionMalwarebytes Labs

    A researcher used two Windows vulnerabilities to perform downgrade attacks. These flaws have now been patched by Microsoft

    newswww.malwarebytes.comAug 15, 2024, 10:38 AM
  • Microsoft patches six actively exploited vulnerabilitiesCSO Online

    Microsoft fixed 88 vulnerabilities on Tuesday as part of its monthly patching cycle. Six of those flaws were already being actively exploited in the wild before a patch was available and another four were publicly disclosed, putting the total number of zero-day vulnerabilities covered in this release at 10. Of the 88 vulnerabilities patched only […]

    newswww.csoonline.comAug 13, 2024, 10:59 PM
  • Microsoft fixes 6 zero-days under active attackHelp Net Security

    August 2024 Patch Tuesday is here, and Microsoft has delivered fixes for 90 vulnerabilities, six of which have been exploited in the wild as zero-days, and four are publicly known. The zero-days under attack CVE-2024-38178 is a Scripting Engine Memory Corruption Vulnerability that could lead to remote code execution. Reported by AhnLab and South Korea’s National Cyber Security Center (NCSC), the flaw can be successfully exploited only if the target uses Microsoft Edge in Internet … More →

    newswww.helpnetsecurity.comAug 13, 2024, 8:09 PM
  • 5 key takeaways from Black Hat USA 2024CSO Online

    The infosecurity world came together in Las Vegas this week for Black Hat USA 2024, offering presentations and product announcements that will give CISOs plenty to consider. Here are the top takeaways CISOs should keep in mind when adapting their cybersecurity strategies going forward. [For more Black Hat USA coverage, see “Black Hat: Latest news […]

    newswww.csoonline.comAug 9, 2024, 7:08 PM
  • Back to the future: Windows Update is now a trojan horse for hackersCSO Online

    A recent discovery has revealed a serious flaw in Microsoft’s Windows Update. Instead of protecting computers, it can be tricked into installing older, vulnerable operating system versions. This allows hackers to bypass security measures and attack computers even with the latest updates installed. It’s like dialing back time to find the perfect vulnerability to exploit. […]

    newswww.csoonline.comAug 8, 2024, 11:45 AM
  • “Perfect” Windows downgrade attack turns fixed vulnerabilities into zero-daysHelp Net Security

    A researcher has developed a downgrade attack that can make Windows machines covertly, persistently and irreversibly vulnerable, even if they were fully patched before that. A downgrade attack exploiting the Windows Update process The direction of SafeBreach researcher Alon Leviev’s probing was inspired by the BlackLotus UEFI bootkit, which was able to bypass the UEFI Secure Boot by exploiting a vulnerability, as well as disable Windows security mechanisms (e.g., BitLocker, HVCI, and Windows Defender) and … More →

    newswww.helpnetsecurity.comAug 8, 2024, 9:53 AM
  • Windows Update Flaws Allow Undetectable Downgrade AttacksSecurityWeek

    Researcher showcases hack against Microsoft Windows Update architecture, turning fixed vulnerabilities into zero-days.

    newswww.securityweek.comAug 7, 2024, 3:00 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence