CVE-2024-21412

This vulnerability allows an attacker to get around a security check that’s supposed to protect you when you open certain internet shortcut files. A common analogy is a “mailroom rule” that’s meant to stop suspicious packages, and this bug is like finding a way to sneak past that rule so the package gets delivered to the wrong place.

This matters to you if you use or run the affected Microsoft Windows versions: Microsoft Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 21H2, Windows 11 22H2, Windows 11 23H2, Windows Server 2019, Windows Server 2022, and Windows Server 2022 23H2. If any of your company computers or servers are still on these versions, they’re in the risky group.

This is RED for a reason: it’s already being exploited in the wild, including in ransomware activity, and it has a very high estimated likelihood of being targeted soon. Even though a public exploit wasn’t confirmed as available, real-world exploitation is already happening, so waiting increases your odds of being hit through phishing or malicious files.

1. Identify exposure

• Confirm which devices run: Microsoft Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 21H2, Windows 11 22H2, Windows 11 23H2, Windows Server 2019, Windows Server 2022, and Windows Server 2022 23H2.

2. Patch/upgrade

• Install the vendor security update(s) that address CVE-2024-21412 on every affected endpoint and server.
• If you cannot patch a device because it’s out of support or stuck on an older branch, plan an urgent upgrade to a supported Windows version.

3. Reduce the chance of malicious file delivery while patching

• Enforce strong email and download controls (especially for messages containing external links or file attachments).
• Instruct users not to open internet shortcut files or similar unexpected “shortcut” content, even if it looks familiar.

4. Monitoring and follow-up

• Watch for signs of compromise per your incident response process (for example: unusual user activity, new scheduled tasks, unexpected access to shared files, or suspicious execution after receiving email).
• Since this is known exploited in the wild, treat repeated detections as urgent and escalate quickly to your IT/security contact.

5. Confirm results

• Re-check patch compliance after updates to ensure every listed version is fixed.
• Validate that devices aren’t missing required updates due to deferrals or misconfigured update policies.

CVE-2024-21412 is a “Internet Shortcut Files Security Feature Bypass Vulnerability.” The key point is that it bypasses a Windows security feature intended to protect users when handling internet shortcut files, enabling attackers to perform actions that the security feature was supposed to block.

Known exploited in the wild: yes (CISA KEV) and press reports indicate exploitation in the wild (itw), including ransomware use.

Affected products (as provided): microsoft windows 10 1809, microsoft windows 10 21h2, microsoft windows 10 22h2, microsoft windows 11 21h2, microsoft windows 11 22h2, microsoft windows 11 23h2, microsoft windows server 2019, microsoft windows server 2022, microsoft windows server 2022 23h2.

Exploit availability: public exploit available = no (not confirmed), but exploitation is already occurring, so practical risk remains.

Weakness/attack vector (limited to provided context): security feature bypass via internet shortcut files.

EPSS/KEV meaning here: EPSS is an estimate of how likely an exploit is to be used in the near term (93.8% in the next 30 days here). KEV (CISA Known Exploited Vulnerabilities) means it has been observed being exploited in real attacks, which is why it’s treated as urgent.