CVE WatchAug 10, 2026

CVE-2024-38217

Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability

CVSS

5.4

Medium

EPSS

10.0%

p96

KEV

YES

Sep 10, 2024

Exploit Today

0-100

Published: Sep 10, 2024 · Last modified: Aug 10, 2026 · CWE-693

EPSS · 30d

10.0%EPSS · 30 days10.0%

2026-09-162026-10-14

KEV catalog record

Product

Microsoft / Windows

Vulnerability

Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability

Added to KEV

Sep 10, 2024

Remediate by

Oct 1, 2024

Known ransomware use

Summary description

Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38217; https://nvd.nist.gov/vuln/detail/CVE-2024-38217

Technical description

Windows Mark of the Web Security Feature Bypass Vulnerability

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1108664.7 MED

—

——0Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.14h CVE-2026-1106895.3 MED

—

——0A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. Performing a manipulation results in protection mechanism failure. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.1.7 will fix this issue. The patch is named 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.16h CVE-2026-668746.5 MED

—

——0For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from running. Because skipped statuses count as success, branch protection or organization-required workflow checks can appear satisfied without the mandated workflow executing; no runner or maintainer approval is required for this path.21h CVE-2026-969518.8 HIG

73.8%

KEV—72Microsoft Windows Command Injection Vulnerability19h CVE-2026-9460310.0 CRI

59.4%

——18Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.2d CVE-2026-888385.5 MED

1.3%

——0A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.20h