CVE-2024-30081 Overview
CVE-2024-30081 is a Windows NTLM (New Technology LAN Manager) spoofing vulnerability affecting a broad range of Windows client and server operating systems. Microsoft disclosed the flaw in the July 2024 Patch Tuesday release. The vulnerability is tracked under [CWE-200] information exposure and allows an attacker to spoof identity within the NTLM authentication protocol. Successful exploitation requires local access and user interaction, but yields high impact against confidentiality and integrity. The EPSS score of 23.8% places this CVE in the 97th percentile for exploitation likelihood, indicating meaningful attacker interest despite no confirmed in-the-wild exploitation.
Critical Impact
Attackers can spoof NTLM authentication artifacts to compromise the confidentiality and integrity of affected Windows systems.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2
Discovery Timeline
- 2024-07-09 - CVE-2024-30081 published to NVD
- 2024-07-09 - Microsoft releases security patch through the July 2024 update guide
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-30081
Vulnerability Analysis
The vulnerability resides within the Windows NTLM authentication component. NTLM is a challenge-response protocol used across Windows environments for authenticating users and services. A spoofing weakness in NTLM allows an attacker to misrepresent an identity or authentication artifact to a targeted system. Microsoft classified the flaw under [CWE-200] because it enables exposure of information that should remain restricted to authenticated principals.
Exploitation requires local access to the target and user interaction. The scope remains unchanged, meaning the impact stays within the security boundary of the vulnerable component. Confidentiality and integrity are both rated high, while availability is not affected. This profile aligns with credential relay or hash manipulation scenarios common to NTLM abuse.
Root Cause
The root cause is improper validation of NTLM authentication material within Windows. Microsoft's advisory does not release full internals, but the flaw enables an attacker to craft or manipulate NTLM messages so that the receiving service accepts them as belonging to another identity. This class of weakness is consistent with prior NTLM relay and reflection issues in Windows.
Attack Vector
An attacker with local access convinces a user to open a crafted file or interact with a malicious resource. The action triggers an outbound or in-process NTLM exchange that the attacker manipulates. The attacker then leverages the spoofed authentication to read protected data or modify resources on behalf of the victim. Reference details are available in the Microsoft Security Update CVE-2024-30081 advisory.
Detection Methods for CVE-2024-30081
Indicators of Compromise
- Unexpected NTLM authentication events in Security event logs (Event IDs 4624, 4625, 4776) originating from unusual processes or users.
- Outbound SMB or HTTP connections to untrusted hosts immediately following user interaction with attachments or links.
- Anomalous NTLM traffic to endpoints that should only use Kerberos.
Detection Strategies
- Correlate process execution telemetry with subsequent NTLM authentication attempts to identify user-initiated exploitation chains.
- Alert on NTLM authentications to external or non-domain-joined destinations, which frequently indicate relay or coercion abuse.
- Baseline NTLM usage per host and flag deviations that follow document opens or shortcut executions.
Monitoring Recommendations
- Enable NTLM auditing through Group Policy (Network security: Restrict NTLM audit settings) to record incoming and outgoing NTLM traffic.
- Forward Windows Security and NTLM operational logs to a centralized SIEM for cross-host correlation.
- Monitor for creation of .url, .lnk, .rtf, and Office documents that reference remote UNC paths.
How to Mitigate CVE-2024-30081
Immediate Actions Required
- Apply the July 2024 Microsoft security updates to all affected Windows 10, Windows 11, and Windows Server systems.
- Inventory endpoints and servers against the affected product list and prioritize domain controllers and internet-facing hosts.
- Restrict outbound SMB (TCP 445) traffic at the perimeter to block off-network NTLM coercion.
Patch Information
Microsoft released fixes as part of the July 9, 2024 update cycle. Patch details, KB identifiers, and product-specific downloads are available in the Microsoft Security Update CVE-2024-30081 advisory. Administrators should validate installation through Get-HotFix or Windows Update for Business reporting.
Workarounds
- Enforce SMB signing and Extended Protection for Authentication (EPA) on servers accepting NTLM.
- Disable NTLM where feasible using the Network security: Restrict NTLM Group Policy settings and migrate services to Kerberos.
- Block outbound NTLM to remote servers for privileged accounts through Group Policy to limit relay exposure.
# Configuration example: audit and restrict outgoing NTLM traffic via Group Policy
# Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
# 1. Audit outgoing NTLM to remote servers
Network security: Restrict NTLM: Audit Outgoing NTLM traffic to remote servers = Audit all
# 2. After baselining, enforce the block
Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers = Deny all
# 3. Require SMB signing
Microsoft network client: Digitally sign communications (always) = Enabled
Microsoft network server: Digitally sign communications (always) = Enabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
