CVE WatchAug 10, 2026

CVE-2024-38014

Microsoft Windows Installer Improper Privilege Management Vulnerability

CVSS

7.8

High

EPSS

6.3%

p93

KEV

YES

Sep 10, 2024

Exploit Today

0-100

Published: Sep 10, 2024 · Last modified: Aug 10, 2026 · CWE-269

EPSS · 30d

6.3%EPSS · 30 days6.3%

2026-08-022026-08-31

KEV catalog record

Product

Microsoft / Windows

Vulnerability

Microsoft Windows Installer Improper Privilege Management Vulnerability

Added to KEV

Sep 10, 2024

Remediate by

Oct 1, 2024

Known ransomware use

Summary description

Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38014; https://nvd.nist.gov/vuln/detail/CVE-2024-38014

Technical description

Windows Installer Elevation of Privilege Vulnerability

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-797448.8 HIG

—

———MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint (handler updateSystemConfig) performs no authorization check. It is protected only by the app-wide authentication middleware and a rate limiter — it never inspects req.user.isAdmin. This issue has been patched in version 1.0.29.2h CVE-2026-828078.8 HIG

—

———A vulnerability was determined in ieungSoft Ultra RAMDisk Pro 1.82. This issue affects some unknown processing in the library URDSCSI.sys of the component Kernel Driver. This manipulation causes improper privilege management. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.4h CVE-2026-826713.4 LOW

5.3%

——2A vulnerability has been found in IObit Unlocker 1.3.0.12. This vulnerability affects the function ZwTerminateProcess in the library IObitUnlocker.sys of the component IRP_MJ_DEVICE_CONTROL Handler. The manipulation leads to improper privilege management. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.10h CVE-2026-826704.4 MED

4.1%

——1A flaw has been found in IObit Uninstaller 15.5.0.11. This affects the function IRP_MJ_DEVICE_CONTROL in the library IUForceDelete.sys of the component IOCTL Handler. Executing a manipulation can lead to improper privilege management. The attack requires local access. The vendor was contacted early about this disclosure but did not respond in any way.5h CVE-2026-828609.8 CRI

22.3%

——7@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.5h CVE-2026-828579.8 CRI

20.5%

——6hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account.11h