{"id":"CVE-2024-38217","published":"2024-09-10T17:15:24Z","modified":"2026-08-10T16:19:03Z","title":"Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"Windows Mark of the Web Security Feature Bypass Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a Mark of the Web protection mechanism failure in the Windows product, specifically within Windows' MOTW security feature, which is meant to flag files downloaded from untrusted sources. An attacker can bypass that security feature over the network with no privileges or authentication required, but the attack needs a user to interact with a crafted file or link, and it can lead to limited integrity and availability impact.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:10Z"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","provenance":"source","from":"NVD"},"epss":{"score":0.10026,"percentile":0.95604,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-09-10","dueDate":"2024-10-01","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38217; https://nvd.nist.gov/vuln/detail/CVE-2024-38217","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-09-10","exploitedFirstSeen":"2024-09-10","ransomware":false,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Sep","date":"2024-09-10"},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38217","date":"2024-09-10"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-09-10"},{"url":"https://www.zerodayinitiative.com/blog/2024/9/10/the-september-2024-security-update-review","date":"2024-09-10"},{"url":"https://www.ptsecurity.com/ru-ru/research/analytics/dajdzhest-trendovyh-uyazvimostej-sentyabr-2024-goda/","date":"2024-10-09"},{"url":"https://asec.ahnlab.com/ko/87042/","date":"2025-03-27"},{"url":"https://asec.ahnlab.com/en/90299/","date":"2025-09-18"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-693","name":"Protection Mechanism Failure"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38217","tags":["Patch","Vendor Advisory"]},{"url":"https://www.elastic.co/security-labs/dismantling-smart-app-control","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38217","tags":["US Government Resource"]}],"techniques":[{"id":"T1553.005","name":"Mark-of-the-Web Bypass","tactics":["defense-impairment"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Bypasses Mark-of-the-Web protection mechanism","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Windows Mark of the Web Security Feature Bypass Vulnerability","start":0,"end":61}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-37184","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-37184","exploited":true,"exploitedSince":"2024-09-10","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://www.elastic.co/security-labs/dismantling-smart-app-control"],"flow":[{"stage":"exploitation","techniques":["T1553.005"],"provenance":"ai"}],"timeline":[{"date":"2024-09-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38217","provenance":"source"},{"date":"2024-09-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Sep","provenance":"source"},{"date":"2024-09-10","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-09-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-37184","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":0},"priority":{"score":65.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 780 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.12,"detail":"percentile 0.9560"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":3.78,"detail":"base score 5.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-693"}}