Microsoft Patch Tuesday — March 2024

Tuesday, 12 March 2024

Vulnerabilities: 61
Critical: 2
High: 45
Zero-days: 0
Public exploit: 3

Exploited 1

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

High 7.8
CVE-2024-26169 Exploited Public exploit Windows Error Reporting Service Elevation of Privilege Vulnerability
EPSS 4%

Critical 2

Critical 9.8
CVE-2024-21334 Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
EPSS 20%
Critical 9.0
CVE-2024-21400 Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
EPSS 2.2%

Public exploit code 2

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 7.8
CVE-2024-26170 Public exploit Windows Composite Image File System (CimFS) Elevation of Privilege Vulnerability
EPSS 6.6%
Medium 5.5
CVE-2024-26160 Public exploit Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability
EPSS 11%

All vulnerabilities 61

Critical2 Show

Critical 9.8
CVE-2024-21334 Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
EPSS 20%
Critical 9.0
CVE-2024-21400 Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
EPSS 2.2%

High45 Show

High 7.8
CVE-2024-26169 Exploited Public exploit Windows Error Reporting Service Elevation of Privilege Vulnerability
EPSS 4%
High 8.8
CVE-2024-21411 Skype for Consumer Remote Code Execution Vulnerability
EPSS 2.6%
High 8.8
CVE-2024-21435 Windows OLE Remote Code Execution Vulnerability
EPSS 2%
High 8.8
CVE-2024-21440 Microsoft ODBC Driver Remote Code Execution Vulnerability
EPSS 2%
High 8.8
CVE-2024-21441 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 1.9%
High 8.8
CVE-2024-21444 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 1.9%
High 8.8
CVE-2024-21450 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 2%
High 8.8
CVE-2024-21451 Microsoft ODBC Driver Remote Code Execution Vulnerability
EPSS 1.9%
High 8.8
CVE-2024-26159 Microsoft ODBC Driver Remote Code Execution Vulnerability
EPSS 1.9%
High 8.8
CVE-2024-26161 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 1.9%
High 8.8
CVE-2024-26162 Microsoft ODBC Driver Remote Code Execution Vulnerability
EPSS 2%
High 8.8
CVE-2024-26164 Microsoft Django Backend for SQL Server Remote Code Execution Vulnerability
EPSS 2.1%
High 8.8
CVE-2024-26165 Visual Studio Code Elevation of Privilege Vulnerability
EPSS 1.9%
High 8.8
CVE-2024-26166 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
EPSS 2%
High 8.8
CVE-2024-26198 Microsoft Exchange Server Remote Code Execution Vulnerability
EPSS 6.8%
High 8.1
CVE-2024-21407 Windows Hyper-V Remote Code Execution Vulnerability
EPSS 16%
High 7.8
CVE-2024-26170 Public exploit Windows Composite Image File System (CimFS) Elevation of Privilege Vulnerability
EPSS 6.6%
High 7.8
CVE-2024-21330 Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
High 7.8
CVE-2024-21418 Software for Open Networking in the Cloud (SONiC) Elevation of Privilege Vulnerability
High 7.8
CVE-2024-21426 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 3.9%
High 7.8
CVE-2024-21431 Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
High 7.8
CVE-2024-21434 Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability
High 7.8
CVE-2024-21436 Windows Installer Elevation of Privilege Vulnerability
High 7.8
CVE-2024-21437 Windows Graphics Component Elevation of Privilege Vulnerability
EPSS 8%
High 7.8
CVE-2024-21442 Windows USB Print Driver Elevation of Privilege Vulnerability
High 7.8
CVE-2024-21446 NTFS Elevation of Privilege Vulnerability
High 7.8
CVE-2024-26173 Windows Kernel Elevation of Privilege Vulnerability
High 7.8
CVE-2024-26176 Windows Kernel Elevation of Privilege Vulnerability
High 7.8
CVE-2024-26178 Windows Kernel Elevation of Privilege Vulnerability
High 7.8
CVE-2024-26182 Windows Kernel Elevation of Privilege Vulnerability
EPSS 5.6%
High 7.8
CVE-2024-26199 Microsoft Office Elevation of Privilege Vulnerability
EPSS 1.2%
High 7.6
CVE-2024-21419 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
EPSS 1.1%
High 7.5
CVE-2024-21392 .NET and Visual Studio Denial of Service Vulnerability
EPSS 3.1%
High 7.5
CVE-2024-21421 Azure SDK Spoofing Vulnerability
EPSS 1.8%
High 7.5
CVE-2024-21427 Windows Kerberos Security Feature Bypass Vulnerability
EPSS 1.5%
High 7.5
CVE-2024-21438 Microsoft AllJoyn API Denial of Service Vulnerability
EPSS 2.7%
High 7.5
CVE-2024-26190 Microsoft QUIC Denial of Service Vulnerability
EPSS 3%
High 7.5
CVE-2024-26204 Outlook for Android Information Disclosure Vulnerability
EPSS 2.1%
High 7.3
CVE-2024-21443 Windows Kernel Elevation of Privilege Vulnerability
EPSS 1.3%
High 7.3
CVE-2024-26203 Azure Data Studio Elevation of Privilege Vulnerability
High 7.1
CVE-2024-21390 Microsoft Authenticator Elevation of Privilege Vulnerability
EPSS 1.3%
High 7.0
CVE-2024-21432 Windows Update Stack Elevation of Privilege Vulnerability
High 7.0
CVE-2024-21433 Windows Print Spooler Elevation of Privilege Vulnerability
EPSS 5.1%
High 7.0
CVE-2024-21439 Windows Telephony Server Elevation of Privilege Vulnerability
High 7.0
CVE-2024-21445 Windows USB Print Driver Elevation of Privilege Vulnerability

Medium13 Show

Medium 6.8
CVE-2024-21429 Windows USB Hub Driver Remote Code Execution Vulnerability
Medium 6.6
CVE-2024-26201 Microsoft Intune Linux Agent Elevation of Privilege Vulnerability
Medium 6.5
CVE-2024-26185 Windows Compressed Folder Tampering Vulnerability
EPSS 30%
Medium 6.5
CVE-2024-26197 Windows Standards-Based Storage Management Service Denial of Service Vulnerability
EPSS 2.8%
Medium 5.7
CVE-2024-21430 Windows USB Attached SCSI (UAS) Protocol Remote Code Execution Vulnerability
Medium 5.5
CVE-2024-26160 Public exploit Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability
EPSS 11%
Medium 5.5
CVE-2024-20671 Microsoft Defender Security Feature Bypass Vulnerability
Medium 5.5
CVE-2024-21408 Windows Hyper-V Denial of Service Vulnerability
EPSS 4.5%
Medium 5.5
CVE-2024-26174 Windows Kernel Information Disclosure Vulnerability
Medium 5.5
CVE-2024-26177 Windows Kernel Information Disclosure Vulnerability
EPSS 1.1%
Medium 5.5
CVE-2024-26181 Windows Kernel Denial of Service Vulnerability
EPSS 1%
Medium 5.0
CVE-2024-21448 Microsoft Teams for Android Information Disclosure Vulnerability
EPSS 1.2%
Medium 4.7
CVE-2024-26163 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
EPSS 2.1%

Low1 Show

Low 3.9
CVE-2024-26246 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability