Patch Tuesday, September 2024
Microsoft's monthly security release, Tuesday, September 10, 2024. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
4 CVEs · 0 critical · 4 exploited · 0 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
4 CVEs · 0 critical · 4 exploited · 0 with public exploit code
- 8.8HighSep 10, 2024Microsoft WindowsCVE-2024-43461Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112.Exploited54% likely
- 7.8HighSep 10, 2024Microsoft Windows Privilege escalationCVE-2024-38014Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.Exploited6.3% likely
- 7.3HighSep 10, 2024Microsoft PublisherCVE-2024-38226Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files.Exploited2.7% likely
- 5.4MediumSep 10, 2024Microsoft WindowsCVE-2024-38217Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.Exploited10% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.