Patch Tuesday, November 2024
Microsoft's monthly security release, Tuesday, November 12, 2024. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
2 CVEs · 0 critical · 2 exploited · 2 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
2 CVEs · 0 critical · 2 exploited · 2 with public exploit code
- 8.8HighNov 12, 2024Microsoft Windows Auth bypass / access controlCVE-2024-49039Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.Exploited14% likelyExploit code
- 6.5MediumNov 12, 2024Microsoft Windows Path traversal / file handlingCVE-2024-43451Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.Exploited84% likelyExploit codeDetection
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.