November Patch Tuesday release contains three critical remote code execution vulnerabilities
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2024-49039+1 related CVE | Windows Task Scheduler Elevation-of-Privilege Flaw Actively Exploited in the Wild | 8.8 group max | 14% | KEVRansomware | KEV |
| CVE-2024-43498 | .NET and Visual Studio Remote Code Execution Vulnerability | 9.8 | 4% | ||
| CVE-2024-43602 | Azure CycleCloud Remote Code Execution Vulnerability | 9.9 | 2% | ||
CVE-2024-43623+1 related CVE | Windows NT OS Kernel Elevation of Privilege Vulnerability | 7.8 | 4% | ||
CVE-2024-43642+1 related CVE | Unauthenticated use-after-free DoS in Windows SMB (Windows 11 / Windows Server) | 7.5 group max | 63% | ||
| CVE-2024-43629 | Windows DWM Core Library Elevation of Privilege Vulnerability | 7.8 | 4% | ||
| CVE-2024-43630 | Windows Kernel Elevation of Privilege Vulnerability | 7.8 | 4% | ||
| CVE-2024-43639 | Windows KDC Proxy Remote Code Execution Vulnerability | 9.8 | 9% | ||
| CVE-2024-49019 | Active Directory Certificate Services Elevation of Privilege Vulnerability | 7.8 | 2% | ||
| CVE-2024-49033 | Microsoft Word Security Feature Bypass Vulnerability | 7.5 | 2% |
From the original article
2 min read at blog.talosintelligence.com
The Patch Tuesday for November of 2024 includes 89 vulnerabilities, including four that Microsoft marked as “critical.” The remaining vulnerabilities listed are classified as “important.” Microsoft assessed that exploitation of the four “critical” vulnerabilities is “less likely.”
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.