Microsoft Patch Tuesday — September 2024

Tuesday, 10 September 2024

Vulnerabilities: 80
Critical: 2
High: 66
Zero-days: 3
Public exploit: 0

Exploited 4

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

High 8.8
CVE-2024-43461 Exploited Windows MSHTML Platform Spoofing Vulnerability
EPSS 54%
High 7.8
CVE-2024-38014 Zero-day Windows Installer Elevation of Privilege Vulnerability
EPSS 6.3%
High 7.3
CVE-2024-38226 Zero-day Microsoft Publisher Security Feature Bypass Vulnerability
EPSS 2.7%
Medium 5.4
CVE-2024-38217 Zero-day Windows Mark of the Web Security Feature Bypass Vulnerability
EPSS 10%

Critical 2

Critical 9.8
CVE-2024-43491 Microsoft Windows Update Remote Code Execution Vulnerability
EPSS 13%
Critical 9.0
CVE-2024-38220 Azure Stack Hub Elevation of Privilege Vulnerability
EPSS 1%

All vulnerabilities 80

Critical2 Show

Critical 9.8
CVE-2024-43491 Microsoft Windows Update Remote Code Execution Vulnerability
EPSS 13%
Critical 9.0
CVE-2024-38220 Azure Stack Hub Elevation of Privilege Vulnerability
EPSS 1%

High66 Show

High 8.8
CVE-2024-43461 Exploited Windows MSHTML Platform Spoofing Vulnerability
EPSS 54%
High 7.8
CVE-2024-38014 Zero-day Windows Installer Elevation of Privilege Vulnerability
EPSS 6.3%
High 7.3
CVE-2024-38226 Zero-day Microsoft Publisher Security Feature Bypass Vulnerability
EPSS 2.7%
High 8.8
CVE-2024-26186 Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
EPSS 1.6%
High 8.8
CVE-2024-26191 Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
EPSS 1.6%
High 8.8
CVE-2024-37335 Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
EPSS 1.6%
High 8.8
CVE-2024-37338 Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
EPSS 1.6%
High 8.8
CVE-2024-37339 Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
EPSS 1.6%
High 8.8
CVE-2024-37340 Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
EPSS 1.6%
High 8.8
CVE-2024-37341 Microsoft SQL Server Elevation of Privilege Vulnerability
EPSS 1.4%
High 8.8
CVE-2024-37965 Microsoft SQL Server Elevation of Privilege Vulnerability
EPSS 1.7%
High 8.8
CVE-2024-37980 Microsoft SQL Server Elevation of Privilege Vulnerability
EPSS 1.4%
High 8.8
CVE-2024-38018 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 51%
High 8.8
CVE-2024-38225 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
EPSS 1.4%
High 8.8
CVE-2024-38259 Microsoft Management Console Remote Code Execution Vulnerability
EPSS 1.9%
High 8.8
CVE-2024-38260 Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
EPSS 1.6%
High 8.8
CVE-2024-43455 Windows Remote Desktop Licensing Service Spoofing Vulnerability
EPSS 1.7%
High 8.8
CVE-2024-43469 Azure CycleCloud Remote Code Execution Vulnerability
EPSS 1.6%
High 8.5
CVE-2024-43479 Microsoft Power Automate Desktop Remote Code Execution Vulnerability
High 8.4
CVE-2024-38194 Azure Web Apps Elevation of Privilege Vulnerability
EPSS 1.3%
High 8.2
CVE-2024-38216 Azure Stack Hub Elevation of Privilege Vulnerability
High 8.1
CVE-2024-21416 Windows TCP/IP Remote Code Execution Vulnerability
EPSS 1.4%
High 8.1
CVE-2024-38045 Windows TCP/IP Remote Code Execution Vulnerability
EPSS 1.4%
High 8.1
CVE-2024-38240 Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
EPSS 1.5%
High 7.8
CVE-2024-30073 Windows Security Zone Mapping Security Feature Bypass Vulnerability
High 7.8
CVE-2024-38046 PowerShell Elevation of Privilege Vulnerability
High 7.8
CVE-2024-38237 Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
EPSS 3.4%
High 7.8
CVE-2024-38238 Kernel Streaming Service Driver Elevation of Privilege Vulnerability
High 7.8
CVE-2024-38241 Kernel Streaming Service Driver Elevation of Privilege Vulnerability
EPSS 6%
High 7.8
CVE-2024-38242 Kernel Streaming Service Driver Elevation of Privilege Vulnerability
EPSS 3.4%
High 7.8
CVE-2024-38243 Kernel Streaming Service Driver Elevation of Privilege Vulnerability
High 7.8
CVE-2024-38244 Kernel Streaming Service Driver Elevation of Privilege Vulnerability
EPSS 6.2%
High 7.8
CVE-2024-38245 Kernel Streaming Service Driver Elevation of Privilege Vulnerability
High 7.8
CVE-2024-38247 Windows Graphics Component Elevation of Privilege Vulnerability
High 7.8
CVE-2024-38249 Windows Graphics Component Elevation of Privilege Vulnerability
High 7.8
CVE-2024-38250 Windows Graphics Component Elevation of Privilege Vulnerability
High 7.8
CVE-2024-38252 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
High 7.8
CVE-2024-38253 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
High 7.8
CVE-2024-43457 Windows Setup and Deployment Elevation of Privilege Vulnerability
High 7.8
CVE-2024-43463 Microsoft Office Visio Remote Code Execution Vulnerability
High 7.8
CVE-2024-43465 Microsoft Excel Elevation of Privilege Vulnerability
High 7.8
CVE-2024-43492 Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
High 7.7
CVE-2024-43458 Windows Networking Information Disclosure Vulnerability
EPSS 1.8%
High 7.6
CVE-2024-43474 Microsoft SQL Server Information Disclosure Vulnerability
EPSS 1.3%
High 7.6
CVE-2024-43476 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
High 7.5
CVE-2024-38119 Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
High 7.5
CVE-2024-38232 Windows Networking Denial of Service Vulnerability
EPSS 2.3%
High 7.5
CVE-2024-38233 Windows Networking Denial of Service Vulnerability
EPSS 2.4%
High 7.5
CVE-2024-38236 DHCP Server Service Denial of Service Vulnerability
EPSS 2.3%
High 7.5
CVE-2024-38257 Microsoft AllJoyn API Information Disclosure Vulnerability
EPSS 4.5%
High 7.5
CVE-2024-38263 Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
EPSS 1.2%
High 7.5
CVE-2024-43467 Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
EPSS 1.1%
High 7.3
CVE-2024-43470 Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
High 7.3
CVE-2024-43475 Microsoft Windows Admin Center Information Disclosure Vulnerability
EPSS 1.8%
High 7.3
CVE-2024-43495 Windows libarchive Remote Code Execution Vulnerability
High 7.2
CVE-2024-38227 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 8.2%
High 7.2
CVE-2024-38228 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 4.2%
High 7.2
CVE-2024-38239 Windows Kerberos Elevation of Privilege Vulnerability
EPSS 1.7%
High 7.2
CVE-2024-43464 Microsoft SharePoint Server Remote Code Execution Vulnerability
EPSS 36%
High 7.1
CVE-2024-37337 Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
EPSS 1.7%
High 7.1
CVE-2024-37342 Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
EPSS 1.7%
High 7.1
CVE-2024-37966 Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
EPSS 2.2%
High 7.1
CVE-2024-38188 Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
High 7.1
CVE-2024-43454 Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
EPSS 22%
High 7.0
CVE-2024-38246 Win32k Elevation of Privilege Vulnerability
High 7.0
CVE-2024-38248 Windows Storage Elevation of Privilege Vulnerability

Medium12 Show

Medium 5.4
CVE-2024-38217 Zero-day Windows Mark of the Web Security Feature Bypass Vulnerability
EPSS 10%
Medium 6.5
CVE-2024-38222 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
EPSS 1.2%
Medium 6.5
CVE-2024-38230 Windows Standards-Based Storage Management Service Denial of Service Vulnerability
EPSS 2.4%
Medium 6.5
CVE-2024-38231 Windows Remote Desktop Licensing Service Denial of Service Vulnerability
EPSS 1.9%
Medium 6.5
CVE-2024-38234 Windows Networking Denial of Service Vulnerability
Medium 6.5
CVE-2024-38235 Windows Hyper-V Denial of Service Vulnerability
Medium 6.5
CVE-2024-38258 Windows Remote Desktop Licensing Service Information Disclosure Vulnerability
EPSS 4.7%
Medium 6.5
CVE-2024-43466 Microsoft SharePoint Server Denial of Service Vulnerability
EPSS 4.5%
Medium 6.5
CVE-2024-43482 Microsoft Outlook for iOS Information Disclosure Vulnerability
EPSS 1.1%
Medium 6.5
CVE-2024-43487 Windows Mark of the Web Security Feature Bypass Vulnerability
EPSS 1.2%
Medium 5.5
CVE-2024-38254 Windows Authentication Information Disclosure Vulnerability
Medium 5.5
CVE-2024-38256 Windows Kernel-Mode Driver Information Disclosure Vulnerability