CVE-2024-38107

What it actually does

CVE-2024-38107 is a local elevation-of-privilege vulnerability in the Windows Power Dependency Coordinator component affecting multiple Windows 10, Windows 11, and Windows Server releases. An attacker who already has local code execution with low privileges can exploit the flaw to gain high-integrity privileges, likely SYSTEM-level execution, resulting in full confidentiality, integrity, and availability impact on the affected host. The vulnerability is not remotely exploitable by itself, but it is highly valuable as a post-compromise privilege escalation step after phishing, malware execution, stolen credentials, or exploitation of another initial-access vulnerability.

Why it matters to the business

Successful exploitation can turn a limited user compromise into full control of a Windows workstation or server, enabling credential theft, security tool tampering, lateral movement, data theft, and deployment of additional malware. Because this vulnerability is listed in CISA KEV, has confirmed exploitation in the wild, and had a federal remediation due date of 2024-09-03, unpatched systems should be treated as materially exposed even though the EPSS score is relatively low. The broad Windows desktop and server impact increases operational risk across endpoint fleets, shared servers, and administrative workstations.

How an attack unfolds

An attacker first obtains the ability to run code as a standard or otherwise low-privileged local user on a vulnerable Windows system. They then invoke the vulnerable Windows Power Dependency Coordinator behavior through a crafted local interaction, causing the operating system component to perform privileged actions incorrectly. If exploitation succeeds, the attacker obtains elevated execution on the same machine, commonly enabling creation of privileged processes, credential dumping, persistence installation, defense evasion, or lateral movement. In real intrusions, this type of flaw is typically chained after initial access to bypass least-privilege controls and quickly convert a single foothold into administrative control of the host.

How to fix it

Install the Microsoft security update that addresses CVE-2024-38107 for every affected Windows release, or a later cumulative update for the applicable Windows branch. Prioritize Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and Windows Server 2022 23H2 systems listed as affected. Where patching cannot be completed immediately, reduce exposure by limiting interactive logon rights, removing unnecessary local administrator access, enforcing application control, enabling credential protection features, monitoring for suspicious privilege escalation, and isolating high-risk systems until updates can be applied. Because this is a local privilege-escalation issue, network controls alone are not sufficient mitigation.

How to confirm the fix worked

Verify that each affected Windows system has installed the relevant August 2024 Microsoft security update or a later cumulative update from Microsoft. Use enterprise patch management, Windows Update history, Microsoft Security Update Guide mappings, or vulnerability scanner authenticated checks to confirm remediation. Validate the OS build and installed KB level for each Windows release rather than relying only on product name. Where file-level validation is required, compare the Power Dependency Coordinator-related Windows component versions, including pdc.sys where applicable, against Microsoft-published patched versions for the specific OS build. Re-scan after patching and confirm the vulnerability no longer appears in authenticated vulnerability assessment results.

Typical attack path

1. Gain initial local code execution on a vulnerable Windows workstation or server through phishing, malware, stolen credentials, or another exploit.
2. Confirm the host is running an affected Windows build that has not received the August 2024 security update or a later cumulative update.
3. Execute a local privilege-escalation payload that abuses the Windows Power Dependency Coordinator vulnerability.
4. Spawn or inject into a high-privilege process running as SYSTEM or an administrator-equivalent context.
5. Disable or tamper with endpoint defenses, collect credentials, install persistence, or move laterally to other systems.

How to detect it

There are no widely reliable, public, vulnerability-specific indicators that uniquely prove exploitation of this flaw. Detection should focus on post-exploitation behavior around unexpected privilege changes on Windows systems that were unpatched at the time. Review Windows Security logs, Sysmon, EDR telemetry, PowerShell logs, service-control events, scheduled task events, driver-load events, and endpoint protection alerts. Useful pivots include Event ID 4688 process creation where a low-privileged user context is followed by SYSTEM-level cmd.exe, powershell.exe, pwsh.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, mshta.exe, or other living-off-the-land binaries; Event ID 4672 special privileges assigned to a logon shortly after suspicious user activity; Event ID 7045 new service installation; scheduled task creation events; credential-access detections; and tampering with Defender, EDR, logging, or backup agents. Correlate suspicious activity with patch state: systems missing the August 2024 or later cumulative update during the activity window deserve higher suspicion. Also review crash telemetry, Windows Error Reporting, and EDR exploit-prevention events involving the Power Dependency Coordinator or pdc.sys, but treat those as investigative leads rather than definitive proof.

What your security team should do

• Treat this as high priority because it is in CISA KEV and has active exploitation in the wild, despite a modest EPSS score.
• Patch all affected Windows endpoints and servers with the applicable August 2024 or later cumulative update, prioritizing internet-facing servers, remote-access hosts, administrator workstations, and systems used by privileged users.
• Run authenticated vulnerability scans or patch compliance queries to identify systems missing the relevant Windows cumulative update.
• Review recent endpoint telemetry for suspicious local privilege escalation, especially low-privileged user processes that quickly lead to SYSTEM-level command shells, scripting engines, credential tools, or security-control tampering.
• Harden post-compromise paths by enforcing least privilege, removing unnecessary local admin rights, enabling Microsoft Defender Credential Guard where supported, and applying application control policies.
• Increase monitoring for suspicious process creation, new services, scheduled tasks, driver loads, credential access, and EDR/AV disablement on systems that were unpatched after the KEV due date.
• If exploitation is suspected, preserve volatile evidence and endpoint telemetry before reimaging, because local privilege escalation artifacts may be overwritten by normal Windows activity.