{"id":"CVE-2024-6769","aliases":["EUVD-2024-47802","GHSA-qmr2-j5m9-cq3m"],"status":"published","title":"Medium to High Integrity Privilege Escalation in Microsoft Windows","description":"A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated attacker to elevate from a medium integrity process to a high integrity process without the intervention of a UAC prompt.","severity":{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01441,"percentile":0.73542,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-426","CWE-427"],"published":"2024-09-26T20:18:38Z","modified":"2026-06-17T08:18:40Z","exploits":[{"source":"pocgithub","id":"fortra/CVE-2024-6769","title":"fortra/CVE-2024-6769","date":"2024-08-29","url":"https://github.com/fortra/CVE-2024-6769"}],"products":[{"vendor":"microsoft","product":"windows 10"},{"vendor":"microsoft","product":"windows 11"},{"vendor":"microsoft","product":"windows server 2016"},{"vendor":"microsoft","product":"windows server 2019"},{"vendor":"microsoft","product":"windows server 2022"},{"vendor":"microsoft","product":"windows_10"},{"vendor":"microsoft","product":"windows_11"},{"vendor":"microsoft","product":"windows_server_2016"},{"vendor":"microsoft","product":"windows_server_2019"},{"vendor":"microsoft","product":"windows_server_2022"}],"references":[{"url":"https://www.fortra.com/security/advisories/research/fr-2024-002"},{"url":"https://github.com/fortra/CVE-2024-6769","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6769"},{"url":"https://github.com/advisories/GHSA-qmr2-j5m9-cq3m"}],"sources":{"cve":[{"id":"CVE-2024-6769","title":"Medium to High Integrity Privilege Escalation in Microsoft Windows","description":"A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated attacker to elevate from a medium integrity process to a high integrity process without the intervention of a UAC prompt.","status":"published","published":"2024-09-26T20:18:38.46Z","modified":"2025-08-29T20:22:43.078Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-426","CWE-427"],"updated_at":"2026-11-02T14:34:11.305983Z"}],"euvd":[{"id":"EUVD-2024-47802","description":"A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated attacker to elevate from a medium integrity process to a high integrity process without the intervention of a UAC prompt.","status":"published","published":"2024-09-26T20:18:38Z","modified":"2025-08-29T20:22:43Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T20:31:49.168932Z"}],"ghsa":[{"id":"GHSA-qmr2-j5m9-cq3m","title":"A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in...","description":"A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated attacker to elevate from a medium integrity process to a high integrity process without the intervention of a UAC prompt.","status":"published","published":"2024-09-26T21:31:11Z","modified":"2025-08-29T21:33:04Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"},{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T15:03:27.857466Z"}],"nvd":[{"id":"CVE-2024-6769","description":"A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated attacker to elevate from a medium integrity process to a high integrity process without the intervention of a UAC prompt.","status":"published","published":"2024-09-26T21:15:07.787Z","modified":"2026-06-17T08:18:40.467Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-426","CWE-427"],"updated_at":"2026-11-02T14:10:29.044588Z"}]}}