Loading story…
SafeBreach researcher Alon Leviev disclosed two Windows zero-day vulnerabilities, CVE-2024-21302 and CVE-2024-38202, that enable downgrade attacks against Windows Backup and a subset of Azure Virtual Machine SKUs. The flaws allow attackers to roll Windows components back to older, vulnerable versions while Windows Update can still report the system as fully updated, affecting Windows 10, Windows 11, and Windows Server deployments.
The downgrade technique can be used for privilege escalation, to reintroduce previously mitigated flaws, and to bypass some Virtualization Based Security (VBS) protections, potentially exposing data protected by VBS. Reporting on the disclosure said exploitation of CVE-2024-38202 additionally requires interaction from a privileged user, and Microsoft had not released a patch at the time, instead pointing customers to mitigation guidance in its Security Update Guide entries for both vulnerabilities.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
At the time of the disclosure, Microsoft had no patch available for CVE-2024-21302 and CVE-2024-38202 and instead recommended mitigation steps. The issues affected Windows 10, Windows 11, and Windows Server, and CVE-2024-38202 additionally required interaction from a privileged user.
At Black Hat 2024, researcher Alon Leviev disclosed CVE-2024-21302 and CVE-2024-38202, two Windows downgrade vulnerabilities affecting Windows Backup and some Azure Virtual Machine SKUs. The flaws could allow privilege escalation by rolling components back to older vulnerable versions while Windows Update still reports the system as fully updated.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released fixes for 61 vulnerabilities in its May security updates, including three zero-days and one critical flaw, with **CVE-2024-30040** and **CVE-2024-30051** confirmed as actively exploited in the wild. The patched issues affect core Microsoft products including Windows, Office, SharePoint, .NET, Visual Studio, and Windows Server, and include a **Windows MSHTML Platform security feature bypass** and a **Windows DWM Core Library elevation-of-privilege flaw** that can allow attackers to gain `SYSTEM` privileges. Researchers who reported **CVE-2024-30051** said they validated the Windows Desktop Window Manager flaw after finding a suspicious document uploaded to VirusTotal, then later observed an exploit in mid-April being used with **QakBot** and other malware. Kaspersky assessed that multiple threat actors likely had access to the exploit before the patch was released, underscoring the urgency for organizations to deploy Microsoft's updates immediately across affected Windows and server environments.
Jul 24, 2026
Microsoft published security advisories for several vulnerabilities affecting **Windows Virtualization-Based Security (VBS)** and **VBS Enclave** components, including elevation-of-privilege issues tracked as `CVE-2025-48803`, `CVE-2025-48811`, and `CVE-2025-53717`. The advisories indicate that flaws in these protected execution and isolation features could allow an attacker to gain higher privileges on affected Windows systems. Microsoft also disclosed `CVE-2025-21340`, a **security feature bypass** in Windows VBS, expanding the scope beyond privilege escalation to weaknesses that could undermine VBS protections themselves. Together, the advisories highlight repeated security issues in Windows virtualization-based isolation mechanisms and reinforce the need for organizations using VBS-backed protections to review affected systems and apply Microsoft updates.
Jul 12, 2026
Microsoft released security updates addressing **79 vulnerabilities** across its product portfolio, including **19 remote code execution** flaws and several issues already under active exploitation. The most severe bug, **`CVE-2024-43491`**, is a **Windows Update** use-after-free vulnerability with a **CVSS 9.8** rating that can allow **unauthenticated remote code execution**. Critical vulnerabilities were also reported in **Microsoft SharePoint Server**, **Azure Web Apps**, **Azure Stack Hub**, and **Windows Network Address Translation**, expanding the risk beyond endpoint systems to server and cloud-connected environments. Microsoft and third-party reporting said attackers were already exploiting **`CVE-2024-38014`** in **Windows Installer**, **`CVE-2024-38217`** in **Mark of the Web**, **`CVE-2024-38226`** in **Microsoft Publisher**, and **`CVE-2024-43491`** in **Windows Update**. The updates were published through Microsoft’s Security Update Guide and release notes, including related Mariner release information, and organizations were urged to prioritize deployment because the exploited flaws span privilege escalation and remote code execution paths across multiple supported Windows versions and Microsoft products.
Jul 24, 2026