CVE-2024-30092: Windows Hyper-V RCE Vulnerability

CVE-2024-30092 Overview

CVE-2024-30092 is a remote code execution vulnerability in Microsoft Windows Hyper-V. The flaw affects the hypervisor stack across supported Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2016 through 2022. Microsoft classifies the weakness under [CWE-20: Improper Input Validation]. An attacker on an adjacent network can send crafted input to a vulnerable Hyper-V host and execute code in a privileged context. Successful exploitation impacts confidentiality, integrity, and availability of the host and any tenant workloads it runs.

Critical Impact
Successful exploitation allows an adjacent-network attacker to execute code against the Hyper-V host, breaking the isolation boundary that separates virtual machines from the hypervisor.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 22H2, 23H2, 24H2)
Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-10-08 - CVE-2024-30092 published to NVD alongside Microsoft's October 2024 Patch Tuesday advisory
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30092

Vulnerability Analysis

The vulnerability resides in Windows Hyper-V, Microsoft's Type-1 hypervisor. Improper input validation in the hypervisor's handling of guest-supplied data permits an attacker to induce unintended behavior across the virtualization boundary. The flaw is classified under [CWE-20], indicating that untrusted input is processed without adequate sanitization or bounds enforcement.

Exploitation requires access to the adjacent network segment where Hyper-V hosts communicate. No authentication is required, and no user interaction is needed. The attack complexity is elevated because the attacker must satisfy specific runtime conditions on the target host. When those conditions are met, code executes in the hypervisor context, undermining the isolation between virtual machines and the host.

Root Cause

The root cause is improper input validation within a Hyper-V component that processes data reachable from adjacent-network sources. Missing or insufficient checks allow malformed input to reach code paths that trust the data implicitly, leading to memory or state corruption exploitable for code execution. Microsoft has not published low-level technical detail beyond the advisory.

Attack Vector

The attack vector is Adjacent Network (AV:A), meaning the attacker must reach the target through a logically adjacent topology such as a shared virtual switch, cluster network, or the same broadcast domain as the Hyper-V host. The attacker sends crafted network traffic that reaches the vulnerable Hyper-V code path. Because the impact scope remains unchanged (S:U), code executes within the Hyper-V security authority.

See the Microsoft CVE-2024-30092 Advisory for vendor guidance. No public proof-of-concept exploit is currently available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-30092

Indicators of Compromise

Unexpected crashes, restarts, or bugchecks of the vmms.exe (Virtual Machine Management Service) or Hyper-V worker processes (vmwp.exe) on hypervisor hosts.
Anomalous adjacent-network traffic targeting Hyper-V hosts on cluster, live-migration, or management VLANs.
New or unexpected child processes spawned by Hyper-V system services following network activity.

Detection Strategies

Monitor Windows Event Log channels Microsoft-Windows-Hyper-V-Worker and Microsoft-Windows-Hyper-V-Hypervisor for errors, unexpected VM terminations, or integrity events.
Baseline east-west traffic on Hyper-V management and cluster networks, and alert on protocol anomalies or malformed packets destined for hypervisor interfaces.
Correlate host telemetry with guest VM behavior to identify cross-VM anomalies that could indicate a hypervisor-level compromise.

Monitoring Recommendations

Ingest Hyper-V, Windows Security, and Sysmon telemetry into a centralized analytics platform for retention and correlation across hosts.
Alert on suspicious process lineage under Hyper-V services, especially child processes of vmms.exe or vmwp.exe that spawn shells or scripting engines.
Track patch compliance across all Hyper-V hosts and flag hosts running unpatched Windows Server or Windows 10/11 builds.

How to Mitigate CVE-2024-30092

Immediate Actions Required

Apply the October 2024 Microsoft security updates to every Hyper-V host running an affected Windows version. This is the primary and vendor-recommended fix.
Inventory all Hyper-V hosts and confirm build numbers against the fixed versions listed in the Microsoft CVE-2024-30092 Advisory.
Restrict adjacent-network access to Hyper-V management, cluster, and live-migration interfaces to trusted administrative segments only.

Patch Information

Microsoft addressed CVE-2024-30092 in the October 8, 2024 security update cycle. Cumulative updates are available through Windows Update, WSUS, and the Microsoft Update Catalog for all affected Windows 10, Windows 11, and Windows Server SKUs. Refer to the vendor advisory for the specific KB article and build number applicable to each release.

Workarounds

Segment Hyper-V cluster, storage, and live-migration networks onto dedicated VLANs with strict access control lists limiting reachability to authorized management hosts.
Where Hyper-V is not required, disable the role using Disable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All until patching is complete.
Enforce host firewall rules that block untrusted traffic to Hyper-V-related services and ports on affected hosts.

bash

# Verify installed updates and Hyper-V status on a Windows host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Get-WindowsFeature -Name Hyper-V | Format-List Name, InstallState
Get-VMHost | Format-List ComputerName, VirtualMachinePath, VirtualHardDiskPath