Microsoft CVEs — PoCs and detection rules¶
43 Microsoft vulnerabilities with detection-only proof-of-concept code and Docker labs; 43 ship ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache). For authorized testing and blue-team detection engineering.
| CVE | Severity | Detection / prevention | PoC |
|---|---|---|---|
| CVE-2026-23652 — Microsoft Power Pages | Critical (10.0) | Snort | ✅ |
| CVE-2026-42901 — Microsoft Entra ID | Critical (10.0) | Snort | ✅ |
| CVE-2024-21334 — Open Mgmt Infra RCE | Critical (9.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-21410 — Exchange Server EoP | Critical (9.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-21413 — Microsoft Outlook RCE | Critical (9.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-38063 — Windows TCP/IP IPv6 RCE | Critical (9.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-43468 — Microsoft SCCM SQLi | Critical (9.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-43491 — Windows Update RCE | Critical (9.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-49112 — Windows LDAP Remote Code Execution | Critical (9.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-20674 — Windows Security Bypass | High (8.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-20698 — Windows Kerberos EoP | High (8.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-29988 — Windows SmartScreen Bypass | High (8.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-30040 — Windows MSHTML Bypass | High (8.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-30078 — Windows Wi-Fi Driver RCE | High (8.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-30088 — Windows Kernel Elevation of Privilege | High (8.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-38189 — Microsoft Project RCE | High (8.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-43453 — Windows RRAS RCE | High (8.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-43461 — Windows MSHTML Spoofing | High (8.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-43532 — Windows RPC EoP | High (8.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-49039 — Windows Task Scheduler | High (8.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-21412 — Windows Defender Bypass | High (8.1) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-21378 — Outlook RCE | High (8.0) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-20656 — VSCode RCE | High (7.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-21338 — Windows Kernel AppLocker Bypass | High (7.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-30051 — Windows DWM EoP | High (7.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-35250 — Windows Kernel EoP | High (7.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-3566 — Windows Env Path | High (7.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-38107 — Windows Power Mgmt EoP | High (7.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-38193 — Windows AFD EoP | High (7.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-43572 — Microsoft MMC RCE | High (7.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-21351 — Windows SmartScreen Security Bypass | High (7.6) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-29059 — .NET Info Disclosure | High (7.5) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-38112 — Windows MSHTML RCE | High (7.5) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-38178 — Microsoft Scripting RCE | High (7.5) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-38200 — Office Spoofing NTLM | High (7.5) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-49113 — Windows LDAP Denial of Service (LDAPNightmare) | High (7.5) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-38202 — Windows Backup EoP | High (7.3) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-38094 — SharePoint RCE | High (7.2) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-38106 — Windows Kernel EoP | High (7.0) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-38213 — Windows Mark of Web Bypass | Medium (6.5) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-43451 — Windows NTLM Hash | Medium (6.5) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2024-43573 — Windows MSHTML Spoofing | Medium (6.5) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2025-21298 — Windows (OLE Component) | Critical | Snort, YARA, Nginx, Apache | ✅ |