Windows Cryptographic Services Security Feature Bypass Vulnerability
CVE-2024-30098 is a security feature bypass vulnerability in Windows Cryptographic Services (rated Important, CVSS 7.5).
1 version
Facts
- Microsoft id
CVE-2024-30098- Products
- Windows Cryptographic Services
- Severity
- Important
- Impact
- Security Feature Bypass
- CVSS
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
- Customer action required
- Yes
- Release
- 2024-Jul
- Assigned by
- Microsoft
- Weakness
- CWE-327: Use of a Broken or Risky Cryptographic Algorithm
- MSRC revision
- 3.2
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2024-07-09:
Information published.
- Revision 1.1, 2024-07-10:
Added FAQ to explain how this vulnerability is being addressed and further actions customers must take to be protected from it.
- Revision 2.0, 2025-03-11:
The following updates have been made to CVE-2024-30098: 1.
- Revision 2.1, 2025-03-26:
Updated links to security updates. This is an informational change only.
- Revision 3.0, 2025-10-14:
The following updates have been made to CVE-2024-30098: 1.
- Revision 3.1, 2025-12-09:
Updated the "Are there any further actions I need to take to be protected from this vulnerability?" FAQ as follows: 1.
- Revision 3.2, 2026-02-10:
DisableCapiOverrideForRSA registry key removal date has been updated to 2/9/2027.
Microsoft says
Are there any further actions I need to take to be protected from this vulnerability? Yes.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Mentioning the same Microsoft ids
Last updated