Microsoft has released its October 2024 Patch Tuesday security updates, addressing a total of 118 vulnerabilities across its software portfolio. This includes two zero-day flaws that are actively being exploited in the wild, underscoring the importance of immediate patching.
Of the 118 vulnerabilities, three are rated Critical, 113 are rated Important, and two are rated Moderate. This release does not include the 25 additional flaws fixed in Microsoft’s Chromium-based Edge browser over the past month.
Among the vulnerabilities disclosed, five were publicly known at the time of release, and two are actively being exploited as zero-day vulnerabilities:
- CVE-2024-43572 (CVSS score: 7.8) – Microsoft Management Console Remote Code Execution (RCE) Vulnerability (Exploitation detected)
- CVE-2024-43573 (CVSS score: 6.5) – Windows MSHTML Platform Spoofing Vulnerability (Exploitation detected)
- CVE-2024-43583 (CVSS score: 7.8) – Winlogon Elevation of Privilege Vulnerability
- CVE-2024-20659 (CVSS score: 7.1) – Windows Hyper-V Security Feature Bypass Vulnerability
- CVE-2024-6197 (CVSS score: 8.8) – Open Source Curl Remote Code Execution Vulnerability (non-Microsoft CVE)
One of the actively exploited flaws, CVE-2024-43573, is similar to other MSHTML spoofing vulnerabilities exploited earlier by the Void Banshee threat actor to deliver the Atlantida Stealer malware.
Despite no specific details about the nature of the active exploitation or the threat actors responsible, Microsoft has implemented measures to prevent exploitation, including blocking untrusted MSC files from being opened. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply patches by October 29, 2024.
In addition to these, the most severe vulnerability addressed is CVE-2024-43468 (CVSS score: 9.8), a remote code execution flaw in Microsoft Configuration Manager. This vulnerability allows unauthenticated attackers to execute arbitrary commands on a target environment through specially crafted requests.
Other Critical-rated vulnerabilities include:
- CVE-2024-43488 (CVSS score: 8.8) – RCE in Visual Studio Code extension for Arduino
- CVE-2024-43582 (CVSS score: 8.1) – RCE in Remote Desktop Protocol (RDP) Server
Outside of Microsoft, other major vendors such as Adobe, Apple, Cisco, Google, VMware, Intel, and Palo Alto Networks have also released security updates in recent weeks to address vulnerabilities in their respective products.
