CVE intelligenceCISA KEVRansomware use

CVE-2022-24521

Microsoft Windows CLFS Driver Privilege Escalation Vulnerability

Published Apr 15, 2022Sources checked Sep 12, 2026

7.8HIGHCVSS out of 10

What this means

Actively exploited

CISA lists CVE-2022-24521 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Microsoft Windows.

Apply updates per vendor instructions.

CISA KEVListedObserved exploitation

EPSS7.1%Estimated 30-day exploitation probability

Ransomware useReported by CISACISA KEV ransomware field

Threat actors1Source-linked actor relationships

Overview

What is CVE-2022-24521?

Windows Common Log File System Driver Elevation of Privilege Vulnerability