Microsoft November 2024 update addresses 91 vulnerabilities, four zero-day flaws, two actively exploited

Microsoft has released its November 2024 security updates addressing 91 vulnerabilities, including four zero-day flaws, with two being actively exploited in the wild. The update batch demonstrates a significant focus on remote code execution vulnerabilities, which comprise approximately 60% of the total fixes.

Vulnerability distribution

• 52 Remote Code Execution vulnerabilities
• 26 Elevation of Privilege vulnerabilities
• 4 Denial of Service vulnerabilities
• 3 Spoofing vulnerabilities
• 2 Security Feature Bypass vulnerabilities
• 1 Information Disclosure vulnerability

Zero-Day Vulnerabilities Under Active Exploitation:

• CVE-2024-43451 (CVSS score 6.5) - NTLM Hash Disclosure Spoofing Vulnerability. Enables attackers to capture user's NTLMv2 hash with minimal interaction and affects all Windows versions. The flaw eequires only minimal user interaction (single click or right-click).
• CVE-2024-49039 (CVSS score 8.8) - Windows Task Scheduler Elevation of Privilege Vulnerability. Allows execution of restricted RPC functions and enables privilege elevation from low-privilege AppContainer.

Publicly Disclosed Zero-Days (Not Yet Exploited):

• CVE-2024-49040 (CVSS score 7.5) - Microsoft Exchange Server Spoofing Vulnerability. Enables sender email address spoofing to local recipients and affects Exchange 2019 CU13/CU14 and Exchange 2016 CU23.
• CVE-2024-49019 (CVSS score 7.8) - Active Directory Certificate Services Elevation of Privilege Vulnerability. Exposes potential for gaining domain administrator privileges and affects systems with Windows Active Directory Certificate Services role

Critical Vulnerabilities fixed:

• CVE-2024-43498 (CVSS score 9.8) - Critical RCE in .NET 9.0 - No privileges or user interaction required
• CVE-2024-43639 (CVSS score 9.8) - Critical RCE in Windows Kerberos - Allows unauthenticated attackers to execute code remotely
• CVE-2024-49056 (CVSS score 7.3, microsoft tagged as critical)- Airlift.microsoft.com Elevation of Privilege Vulnerability
• CVE-2024-43625 (CVSS score 8.1, microsoft tagged as critical) - Microsoft Windows VMSwitch Elevation of Privilege Vulnerability

The update includes patches for Windows 11 (KB5046617 and KB5046633) and Windows 10 (KB5046613)

Users should apply patches immediately, especially for actively exploited vulnerabilities, and install IE cumulative updates and educate users about the active threats, particularly regarding the NTLM hash disclosure vulnerability.

Full vulnerability list: