Microsoft Patch Tuesday — February 2024

Exploited 5

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

• Critical 9.8
  CVE-2024-21413 Exploited Public exploit Microsoft Outlook Remote Code Execution Vulnerability
  EPSS 95%
• Critical 9.8
  CVE-2024-21410 Zero-day Microsoft Exchange Server Elevation of Privilege Vulnerability
  EPSS 13%
• High 8.1
  CVE-2024-21412 Zero-day Public exploit Internet Shortcut Files Security Feature Bypass Vulnerability
  EPSS 99%
• High 7.8
  CVE-2024-21338 Exploited Public exploit Windows Kernel Elevation of Privilege Vulnerability
  EPSS 62%
• High 7.6
  CVE-2024-21351 Zero-day Windows SmartScreen Security Feature Bypass Vulnerability
  EPSS 28%

Critical 4

• Critical 9.8
  CVE-2024-21401 Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability
  EPSS 1.5%
• Critical 9.3
  CVE-2024-21364 Microsoft Azure Site Recovery Elevation of Privilege Vulnerability
• Critical 9.0
  CVE-2024-21376 Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability
  EPSS 1.2%
• Critical 9.0
  CVE-2024-21403 Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
  EPSS 1.3%

All vulnerabilities 72