CVE-2024-21412: Microsoft Windows Internet Shortcut Files security feature bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware campaign use and an EPSS score above the 99th percentile, so active exploitation is expected.

What it is

CVE-2024-21412 is a security feature bypass in Microsoft Windows involving Internet Shortcut Files. The flaw lets an attacker circumvent a Windows security control, and Microsoft rates it 8.1 (HIGH) with a network vector requiring user interaction. It is listed in CISA KEV with known ransomware campaign use, so it is being exploited in the wild.

Impact

An attacker can bypass a Windows security feature, which in observed campaigns is used to deliver further payloads such as malware or ransomware. The CVSS vector shows high confidentiality and integrity impact but no availability impact.

Attack surface

Reached over the network (AV:N) with no privileges required (PR:N), but exploitation requires user interaction (UI:R), typically opening a crafted Internet Shortcut File. No authentication is needed.

Exploitation

CISA added it to KEV on 2024-02-13 with a 2024-03-05 remediation due date and flags known ransomware campaign use. EPSS is 0.95443 (99.866th percentile), indicating very high predicted exploitation activity.

What to do

• Apply the Microsoft security update for CVE-2024-21412 on all affected Windows 10, Windows 11, and Windows Server versions.
• Prioritize patching internet-facing and user-workstation systems, and meet the CISA KEV due date of 2024-03-05.
• Block or restrict execution of Internet Shortcut (.url) files from untrusted sources such as email and web downloads.
• Harden email and browser controls to reduce delivery of malicious shortcut files, and enforce Mark-of-the-Web handling.
• If patching is not immediately possible, apply the vendor mitigations or discontinue use of the affected product as CISA directs.

Detection

• Monitor for creation or execution of .url Internet Shortcut files in user download, temp, and email attachment directories.
• Alert on processes spawned by explorer.exe or browsers that launch unusual child processes after a .url file is opened.
• Hunt for known ransomware precursor activity and payload delivery following shortcut file execution.
• Review endpoint telemetry for security feature bypass behavior and correlate with CISA KEV guidance.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.