Patch days / January 2024

Microsoft Patch Tuesday — January 2024

Tuesday, 9 January 2024

Vulnerabilities: 50
Critical: 1
High: 27
Zero-days: 0
Public exploit: 8

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 1

Critical 9.1
CVE-2024-0057 NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
EPSS 2.8%

Public exploit code 8

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 8.8
CVE-2024-20674 Public exploit Windows Kerberos Security Feature Bypass Vulnerability
EPSS 17%
High 7.8
CVE-2024-20656 Public exploit Visual Studio Elevation of Privilege Vulnerability
EPSS 3.9%
High 7.8
CVE-2024-20698 Public exploit Windows Kernel Elevation of Privilege Vulnerability
EPSS 8.6%
High 7.3
CVE-2024-20696 Public exploit Windows libarchive Remote Code Execution Vulnerability
EPSS 3.2%
Medium 6.6
CVE-2024-20666 Public exploit BitLocker Security Feature Bypass Vulnerability
EPSS 3.1%
Medium 6.5
CVE-2024-21320 Public exploit Windows Themes Spoofing Vulnerability
EPSS 23%
Medium 5.7
CVE-2024-21306 Public exploit Microsoft Bluetooth Driver Spoofing Vulnerability
EPSS 5.8%
Medium 4.4
CVE-2024-21305 Public exploit Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
EPSS 1.5%

All vulnerabilities 50

Critical1 Show

Critical 9.1
CVE-2024-0057 NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
EPSS 2.8%

High27 Show

High 8.8
CVE-2024-20674 Public exploit Windows Kerberos Security Feature Bypass Vulnerability
EPSS 17%
High 8.8
CVE-2024-21318 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 31%
High 8.7
CVE-2024-0056 Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
EPSS 1.2%
High 8.1
CVE-2024-20652 Windows HTML Platforms Security Feature Bypass Vulnerability
EPSS 2.1%
High 8.0
CVE-2024-20654 Microsoft ODBC Driver Remote Code Execution Vulnerability
EPSS 2%
High 8.0
CVE-2024-20676 Azure Storage Mover Remote Code Execution Vulnerability
EPSS 2.7%
High 7.8
CVE-2024-20656 Public exploit Visual Studio Elevation of Privilege Vulnerability
EPSS 3.9%
High 7.8
CVE-2024-20698 Public exploit Windows Kernel Elevation of Privilege Vulnerability
EPSS 8.6%
High 7.8
CVE-2024-20653 Microsoft Common Log File System Elevation of Privilege Vulnerability
EPSS 4.5%
High 7.8
CVE-2024-20658 Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability
High 7.8
CVE-2024-20677 Microsoft Office Remote Code Execution Vulnerability
EPSS 3.3%
High 7.8
CVE-2024-20681 Windows Subsystem for Linux Elevation of Privilege Vulnerability
High 7.8
CVE-2024-20682 Windows Cryptographic Services Remote Code Execution Vulnerability
High 7.8
CVE-2024-20683 Win32k Elevation of Privilege Vulnerability
EPSS 4.2%
High 7.8
CVE-2024-20686 Win32k Elevation of Privilege Vulnerability
High 7.8
CVE-2024-21309 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
High 7.8
CVE-2024-21310 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
EPSS 12%
High 7.8
CVE-2024-21325 Microsoft Printer Metadata Troubleshooter Tool Remote Code Execution Vulnerability
EPSS 1.2%
High 7.5
CVE-2024-20661 Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
EPSS 2.8%
High 7.5
CVE-2024-20672 .NET Denial of Service Vulnerability
EPSS 2.9%
High 7.5
CVE-2024-20687 Microsoft AllJoyn API Denial of Service Vulnerability
EPSS 2.5%
High 7.5
CVE-2024-20700 Windows Hyper-V Remote Code Execution Vulnerability
EPSS 4%
High 7.5
CVE-2024-21307 Remote Desktop Client Remote Code Execution Vulnerability
EPSS 2%
High 7.5
CVE-2024-21312 .NET Framework Denial of Service Vulnerability
EPSS 3.6%
High 7.3
CVE-2024-20696 Public exploit Windows libarchive Remote Code Execution Vulnerability
EPSS 3.2%
High 7.3
CVE-2024-20697 Windows libarchive Remote Code Execution Vulnerability
EPSS 72%
High 7.0
CVE-2024-20657 Windows Group Policy Elevation of Privilege Vulnerability

Medium22 Show

Medium 6.8
CVE-2024-21319 Microsoft Identity Denial of service vulnerability
EPSS 2.9%
Medium 6.6
CVE-2024-20666 Public exploit BitLocker Security Feature Bypass Vulnerability
EPSS 3.1%
Medium 6.6
CVE-2024-20655 Microsoft Online Certificate Status Protocol (OCSP) Remote Code Execution Vulnerability
EPSS 1.4%
Medium 6.5
CVE-2024-21320 Public exploit Windows Themes Spoofing Vulnerability
EPSS 23%
Medium 6.5
CVE-2024-20660 Microsoft Message Queuing Information Disclosure Vulnerability
EPSS 2%
Medium 6.5
CVE-2024-20663 Windows Message Queuing Client (MSMQC) Information Disclosure
EPSS 1.9%
Medium 6.5
CVE-2024-20664 Microsoft Message Queuing Information Disclosure Vulnerability
EPSS 2%
Medium 6.5
CVE-2024-20680 Windows Message Queuing Client (MSMQC) Information Disclosure
EPSS 2%
Medium 6.5
CVE-2024-20690 Windows Nearby Sharing Spoofing Vulnerability
EPSS 1.3%
Medium 6.5
CVE-2024-21314 Microsoft Message Queuing Information Disclosure Vulnerability
EPSS 2.1%
Medium 6.3
CVE-2024-20675 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Medium 6.1
CVE-2024-21316 Windows Server Key Distribution Service Security Feature Bypass
EPSS 1.5%
Medium 5.7
CVE-2024-21306 Public exploit Microsoft Bluetooth Driver Spoofing Vulnerability
EPSS 5.8%
Medium 5.7
CVE-2024-20692 Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
EPSS 1.2%
Medium 5.5
CVE-2024-20694 Windows CoreMessaging Information Disclosure Vulnerability
Medium 5.5
CVE-2024-20699 Windows Hyper-V Denial of Service Vulnerability
Medium 5.5
CVE-2024-21311 Windows Cryptographic Services Information Disclosure Vulnerability
Medium 5.3
CVE-2024-21313 Windows TCP/IP Information Disclosure Vulnerability
EPSS 1.5%
Medium 5.2
CVE-2024-21337 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Medium 4.9
CVE-2024-20662 Windows Online Certificate Status Protocol (OCSP) Information Disclosure Vulnerability
EPSS 1.9%
Medium 4.7
CVE-2024-20691 Windows Themes Information Disclosure Vulnerability
Medium 4.4
CVE-2024-21305 Public exploit Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
EPSS 1.5%