Patch Tuesday, February 2024
Microsoft's monthly security release, Tuesday, February 13, 2024. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
5 CVEs · 2 critical · 5 exploited · 4 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
5 CVEs · 2 critical · 5 exploited · 4 with public exploit code
- 9.8CriticalFeb 13, 2024Microsoft Exchange Server Auth bypass / access controlCVE-2024-21410Microsoft Exchange Server software is affected. An attacker gains elevated privileges and potentially full control over the server. Update Microsoft Exchange Server to the latest version and apply all available security patches.Exploited13% likelyExploit code
- 9.8CriticalFeb 13, 2024Microsoft Office OutlookCVE-2024-21413Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.Exploited95% likelyExploit codeDetection
- 8.1HighFeb 13, 2024Microsoft WindowsCVE-2024-21412Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.Exploited99% likelyExploit code
- 7.8HighFeb 13, 2024Microsoft Windows Memory corruptionCVE-2024-21338Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.Exploited60% likelyExploit codeExploit-DB
- 7.6HighFeb 13, 2024Microsoft Windows Code / command injectionCVE-2024-21351Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both.Exploited28% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.