tenable:212223 · KB5048654: Windows Server 2022 / Azure Stack HCI 22H2 Security…

01 · The Real Story

Your castle's drawbridge and throne room both have unlocked doors, and someone already walked through one of them

KB5048654 is the December 2024 cumulative security update for Windows Server 2022 and Azure Stack HCI 22H2, bundling fixes for 42 CVEs. The headliners are CVE-2024-49112 — a CVSS 9.8 unauthenticated remote code execution flaw in the Windows LDAP client (wldap32.dll) triggered via crafted RPC calls that provoke malicious LDAP referral responses, capable of crashing LSASS and rebooting any unpatched Windows Server — and CVE-2024-49138, a heap-based buffer overflow in the Common Log File System (CLFS) driver that grants SYSTEM privileges to a local attacker and was actively exploited as a zero-day before the patch dropped. The bundle also includes eight critical Remote Desktop Services RCE flaws (CVSS 8.1 each, race-condition gated) and CVE-2024-49113 (LDAP DoS, CVSS 7.5) whose public PoC 'LDAPNightmare' from SafeBreach Labs demonstrates the LSASS crash path. All versions of Windows Server 2022 below OS Build 20348.2966 are affected.

Microsoft rated the overall update as Critical, and that assessment is dead-on. CVE-2024-49138 alone justifies urgency — it's KEV-listed, weaponized, and gives attackers the one thing ransomware operators always need: kernel-level privilege escalation. CVE-2024-49112's CVSS 9.8 is technically fair (AV:N/AC:L/PR:N/UI:N), though the publicly available PoC currently achieves only denial-of-service (LSASS crash), not full RCE. SafeBreach researchers have stated the same exploit chain could be modified to achieve RCE, and multiple forks on GitHub continue to iterate. The RDS cluster adds breadth — nine distinct RCE paths into the same OS. For any enterprise running Windows Server 2022 as domain controllers, Hyper-V hosts, or tier-0 infrastructure, this update is non-negotiable.

"Active zero-day plus unauthenticated LDAP RCE on your domain controllers. Patch now."

02 · The Attack Path

4 steps from start to impact.

STEP 01

Attacker triggers LDAP referral chain (CVE-2024-49112/49113)

An unauthenticated attacker sends a DCE/RPC request to the target Windows Server, causing it to issue a DNS SRV query for the attacker-controlled domain. The attacker's DNS server responds with a hostname and LDAP port, the victim resolves it via NBNS broadcast, and the attacker replies with their IP. The victim then sends a CLDAP request to the attacker, who returns a malicious referral response exploiting an integer overflow in wldap32.dll. This crashes LSASS and forces an immediate reboot. With further refinement of the CLDAP packet payload, the same chain can theoretically achieve RCE in the LDAP service context (SYSTEM).

Conditions required:

Target Windows Server is unpatched (below build 20348.2966)
Target's DNS server can resolve external domains (internet-connected DNS)
Attacker can receive inbound LDAP/NBNS connections from the target

Where this breaks in practice:

Domain controllers in hardened environments may restrict outbound DNS to internal forwarders only
Network segmentation may prevent the DC from reaching attacker-controlled infrastructure on arbitrary ports
Current public PoC (SafeBreach LDAPNightmare) achieves DoS only, not confirmed RCE

Detection/coverage: SafeBreach released Sigma rules and Suricata signatures for CLDAP referral response anomalies. SOCPrime has detection content. Monitor for unusual outbound LDAP/CLDAP traffic from DCs to non-internal IPs.

STEP 02

Attacker escalates to SYSTEM via CLFS zero-day (CVE-2024-49138)

From any local or low-privilege foothold on the target server, the attacker exploits the heap-based buffer overflow in clfs.sys to escalate to SYSTEM. CrowdStrike's Advanced Research Team discovered this being used in the wild prior to the patch. Multiple public PoCs exist on GitHub (MrAle98, bananoname) and ExploitDB (EDB-52270). The CLFS driver is loaded on every Windows system, making this universally reachable from any local code execution context.

Conditions required:

Attacker has local code execution on the target (any privilege level)
Target is unpatched

Where this breaks in practice:

Requires prior initial access — this is a post-compromise escalation, not a remote entry point
Kernel exploit stability varies across builds; some PoCs target specific Windows 11 23H2 offsets

Detection/coverage: CrowdStrike Falcon, Microsoft Defender for Endpoint, and most modern EDR agents detect CLFS heap corruption patterns. CISA added CVE-2024-49138 to KEV on 2024-12-10 with a remediation deadline of 2024-12-31.

STEP 03

Chain: initial access + CLFS = domain compromise

The canonical threat model chains any initial access vector (phishing, exposed service, supply-chain compromise) with CVE-2024-49138 to achieve SYSTEM on the target server. On a domain controller, SYSTEM access means the attacker can run DCSync, dump NTDS.dit, forge golden tickets, or pivot to any domain-joined host. On a Hyper-V host, SYSTEM means hypervisor control and potential guest escape or mass VM manipulation. Ransomware operators have repeatedly targeted CLFS bugs (CVE-2022-24521, CVE-2023-23376, CVE-2023-28252) for exactly this escalation path.

Conditions required:

Successful initial access to any domain-joined Windows Server 2022 host
Target is unpatched for CVE-2024-49138

Where this breaks in practice:

EDR should catch known CLFS exploitation patterns if signatures are current
MFA and credential hygiene limit lateral movement after initial SYSTEM access

Detection/coverage: Post-exploitation activity (DCSync, NTDS dump) triggers alerts in Microsoft Defender for Identity, CrowdStrike Identity Protection, and Semperis Directory Services Protector.

STEP 04

RDS race-condition RCE (CVE-2024-49106 and 7 siblings)

Eight critical Remote Desktop Services vulnerabilities share CVSS 8.1 (AV:N/AC:H/PR:N/UI:N) and require the attacker to win a use-after-free race condition. If RDS/RDP is exposed, an unauthenticated attacker can attempt code execution on the target server. The high attack complexity (AC:H) reduces reliability, but with eight distinct race windows available, an attacker has multiple shots at success. No public PoC exists for any of the eight as of October 2026.

Conditions required:

RDS/RDP service is reachable by the attacker
Target is unpatched
Attacker wins the race condition

Where this breaks in practice:

Race conditions are inherently unreliable — exploitation is probabilistic, not deterministic
Most enterprises gate RDP behind VPN, NLA, or jump servers, limiting direct exposure
No known PoC or in-the-wild exploitation reduces near-term risk

Detection/coverage: Tenable plugin 212223 detects the missing KB. Qualys QID and Rapid7 content also cover these CVEs. Network-level: monitor for anomalous RDP pre-auth traffic patterns.

03 · Compensating Control

CRITICAL 9.5→IGNORE 0.0

SEVERITY REDUCED

Apply KB5048654 or any superseding cumulative update immediately — This is 10 months past release. Per the noisgate mitigation SLA for CRITICAL findings, compensating controls should deploy within 3 days, and per the noisgate remediation SLA, the actual patch should be applied within 90 days. You are well past both deadlines. Prioritize this in your next maintenance window — ideally within hours given the KEV status. The hotpatch KB5048800 is available for Azure Edition hosts to avoid reboots.

CRITICAL 9.5→HIGH 8.0

SEVERITY REDUCED

Block outbound LDAP/CLDAP (389/636/3268/3269) and restrict outbound DNS from domain controllers — The LDAPNightmare chain (CVE-2024-49112/49113) requires the DC's DNS to resolve attacker-controlled domains and the DC to initiate outbound LDAP connections to attacker infrastructure. Restricting DC outbound traffic to known-good DNS forwarders and blocking direct LDAP egress breaks the referral chain. Deploy within 3 days per CRITICAL noisgate mitigation SLA.

CRITICAL 9.5→HIGH 7.8

SEVERITY REDUCED

Enforce Network Level Authentication (NLA) and restrict RDP to jump servers only — NLA adds an authentication gate before the RDS vulnerability surface is reachable, blocking the eight unauthenticated RDS RCE paths (CVE-2024-49106 cluster). Combined with VPN-only RDP access, this eliminates the RDS attack surface for external attackers. Deploy within 3 days.

CRITICAL 9.5→HIGH 7.5

SEVERITY REDUCED

Ensure EDR agents are current and CLFS exploitation detections are active — CVE-2024-49138 CLFS exploitation follows well-known kernel heap corruption patterns. CrowdStrike, Microsoft Defender for Endpoint, and SentinelOne all have detections for CLFS heap overflow exploitation. Verify your EDR policy is set to block (not just alert) on kernel exploitation attempts. This doesn't prevent the vulnerability but catches the exploitation attempt.

CRITICAL 9.5→HIGH 7.5

SEVERITY REDUCED

Segment domain controllers into a dedicated tier-0 VLAN with strict ingress/egress ACLs — Limit which hosts can reach DC ports (LDAP, RPC, Kerberos, DNS) to only authorized member servers and admin workstations. This reduces the attack surface for CVE-2024-49112 by shrinking who can send crafted RPC calls to the DC. Deploy within 3 days for any DC not already segmented.

What doesn't work

WAF / reverse proxy in front of LDAP: LDAP is not HTTP — web application firewalls cannot inspect or filter LDAP/CLDAP traffic. This control is irrelevant.
Disabling the CLFS driver: clfs.sys is a core Windows kernel component loaded at boot. It cannot be disabled or removed without breaking the OS.
Windows Firewall host rules blocking LDAP inbound: CVE-2024-49112 is triggered by the DC making *outbound* LDAP connections to attacker infrastructure, not by inbound LDAP. Blocking inbound LDAP would also break AD authentication for your entire domain.
LDAP channel binding / signing: These controls protect against LDAP relay attacks but do not mitigate the integer overflow in wldap32.dll that CVE-2024-49112 exploits. The flaw is in LDAP *client* processing, not authentication.

04 · Intelligence Metadata

The supporting signals.

In-the-wild exploitation	Confirmed. CVE-2024-49138 was exploited as a zero-day before the December 2024 patch. Discovered by CrowdStrike Advanced Research Team. CLFS driver bugs are a recurring ransomware escalation primitive (CVE-2022-24521, CVE-2023-23376, CVE-2023-28252 preceded this).
CISA KEV status	CVE-2024-49138 added 2024-12-10, remediation deadline 2024-12-31. CVE-2024-49112 is not KEV-listed despite its 9.8 CVSS.
PoC / exploit availability	CVE-2024-49138: Multiple PoCs — MrAle98/CVE-2024-49138-POC, ExploitDB EDB-52270, 55+ GitHub repos per CISA. CVE-2024-49112/49113: SafeBreach 'LDAPNightmare' PoC achieves DoS (LSASS crash), published 2025-01-01 at SafeBreach-Labs/CVE-2024-49113. Full RCE not yet publicly demonstrated. Multiple forks: Dliv3, Dmitri131313.
EPSS scores	CVE-2024-49113: 83.6% (99.7th percentile) · CVE-2024-49112: 71.9% (99.4th percentile) · CVE-2024-49138: 26.2% (98.0th percentile) · CVE-2024-49090: 1.1% (64.3rd percentile). As of 2026-10-19.
CVSS vectors	CVE-2024-49112: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` = 9.8 (unauthenticated network RCE). CVE-2024-49138: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` = 7.8 (local EoP). RDS cluster: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H` = 8.1 each.
Affected versions	Windows Server 2022 all editions (Standard, Datacenter, Azure Edition) and Azure Stack HCI 22H2, OS Build 20348.x below 20348.2966. CVE-2024-49112 and CVE-2024-49138 also affect Server 2008 R2 through Server 2025 on their respective KBs.
Fixed version	OS Build 20348.2966 (KB5048654) or hotpatch KB5048800. Subsequent cumulative updates (January 2025+) supersede this KB.
Scanning / exposure data	Shodan shows ~3.5M RDP-exposed endpoints globally; a fraction are Server 2022. LDAP (port 389/636) exposure on DCs is rarer at the perimeter but common on internal networks. GreyNoise has not tagged specific CVE-2024-49112 scanning activity, though LDAP probe traffic is persistent background noise.
Disclosure / patch date	2024-12-10 (Microsoft Patch Tuesday). CVE-2024-49138 was a zero-day — exploited before this date.
Credited researchers	CVE-2024-49112: Yuki Chen. CVE-2024-49138: CrowdStrike Advanced Research Team. LDAPNightmare PoC: SafeBreach Labs (Or Yair). CVE-2024-49138 PoC: MrAle_98, HN Security (analysis).

Sources.

05 · The Call

Final Verdict

= UNCHANGED to CRITICAL (9.5/10)

Why this verdict

Active zero-day with public weaponization: CVE-2024-49138 was exploited before the patch existed, is KEV-listed, and has 55+ public PoCs including ExploitDB entries. CLFS EoP-to-SYSTEM is the exact primitive ransomware operators chain with any initial access vector. This alone would be HIGH for a local-only bug, but the role multiplier pushes it higher.
Role multiplier — domain controllers: Windows Server 2022 is the canonical OS for Active Directory domain controllers in enterprises that have modernized from 2016/2019. On a DC, CVE-2024-49138 (SYSTEM) = DCSync = domain takeover = fleet compromise. CVE-2024-49112 can crash LSASS on the DC, causing an unplanned reboot — a DoS against authentication infrastructure. ≥30% of Windows Server 2022 deployments in large enterprises serve as DCs or tier-0 identity infrastructure. The blast radius is domain-scale to fleet-scale. This floors the verdict at CRITICAL.
Role multiplier — Hyper-V hosts: Windows Server 2022 is also the primary Hyper-V hypervisor platform. SYSTEM on a Hyper-V host grants control over all guest VMs. Blast radius is host-to-tenant-scale. This independently floors the verdict at HIGH.
CVE-2024-49112 near-term RCE trajectory: The CVSS 9.8 LDAP RCE has a public DoS PoC (LDAPNightmare) and SafeBreach has stated the same chain can be modified for RCE. The integer overflow in wldap32.dll is well-understood. Full weaponized RCE is a matter of engineering effort, not a fundamental barrier. EPSS at 71.9% reflects this trajectory.
Eight additional RDS RCE paths: The race-condition requirement (AC:H) adds friction, but eight independent shots at the same race meaningfully improve attacker odds. No PoC yet, but the surface area is broad.
Patch age — 10 months overdue: This KB was released December 2024. Any host still unpatched in October 2026 has missed 10 subsequent cumulative updates and is exposed to significantly more than these 42 CVEs. The risk compounds with every month of delay.

Why not higher?

A 9.5 is already at the top of the CRITICAL range. The only reason this isn't a flat 10.0 is that CVE-2024-49112's public PoC achieves DoS rather than confirmed RCE, and the RDS vulns require a race condition win. If a reliable public RCE exploit for CVE-2024-49112 drops, this would warrant a 9.8.

Why not lower?

CVE-2024-49138 is a confirmed in-the-wild zero-day targeting a kernel driver present on every Windows system, with dozens of public exploits. Windows Server 2022 canonically serves as domain controllers and Hyper-V hosts — the blast radius on these high-value roles is domain takeover and fleet compromise respectively. The LDAP attack surface (CVE-2024-49112) is unauthenticated and network-reachable on every DC. No amount of friction analysis can push a KEV-listed zero-day on tier-0 infrastructure below CRITICAL.

06 · Verification

Crowdsourced verification payload.

Run on each target Windows Server 2022 host. No admin privileges required (reads registry and WMI). Example: powershell -ExecutionPolicy Bypass -File .\Check-KB5048654.ps1

noisgate-verify.ps1

POWERSHELLREAD-ONLYSAFE

#Requires -Version 5.1
<#
.SYNOPSIS
  Checks whether KB5048654 (December 2024 cumulative) or a superseding
  update is installed on Windows Server 2022 / Azure Stack HCI 22H2.
.OUTPUTS
  VULNERABLE | PATCHED | UNKNOWN  (exit codes 1, 0, 2)
#>
$ErrorActionPreference = 'Stop'
try {
    $os = Get-CimInstance Win32_OperatingSystem
    $caption = $os.Caption
    # Verify target OS
    if ($caption -notmatch 'Server 2022|Azure Stack HCI') {
        Write-Output "UNKNOWN - Not Windows Server 2022 or Azure Stack HCI (detected: $caption)"
        exit 2
    }
    # Read Update Build Revision from registry
    $ubr = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name UBR).UBR
    $buildNum = $os.BuildNumber
    $fullBuild = "$buildNum.$ubr"
    Write-Output "OS      : $caption"
    Write-Output "Build   : $fullBuild"
    # KB5048654 sets build to 20348.2966; any later CU raises it further
    if ($buildNum -eq 20348 -and $ubr -ge 2966) {
        Write-Output "PATCHED - OS Build $fullBuild >= 20348.2966 (KB5048654 or later installed)"
        exit 0
    }
    elseif ($buildNum -eq 20348 -and $ubr -lt 2966) {
        # Double-check via hotfix list
        $hf = Get-HotFix -Id 'KB5048654','KB5048800' -ErrorAction SilentlyContinue
        if ($hf) {
            Write-Output "PATCHED - KB found via Get-HotFix ($($hf.HotFixID -join ', ')), but UBR is low ($fullBuild). Verify reboot completed."
            exit 0
        }
        Write-Output "VULNERABLE - OS Build $fullBuild < 20348.2966 (KB5048654 NOT installed)"
        exit 1
    }
    else {
        Write-Output "UNKNOWN - Unexpected build number $fullBuild (expected 20348.x for Server 2022)"
        exit 2
    }
}
catch {
    Write-Output "UNKNOWN - Error: $($_.Exception.Message)"
    exit 2
}