Microsoft's security release of 13 February 2024
Patch Tuesday, February 2024
As of , CISA lists five of the 72 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2024-21413, Microsoft Outlook Remote Code Execution.
On CISA's list of exploited vulnerabilities
- CVE-2024-21413Microsoft Outlook Remote Code Execution. Listed by CISA on 6 February 2025, 359 days after the release
- CVE-2024-21338Windows Kernel Elevation of Privilege. Listed by CISA on 4 March 2024, 20 days after the release
- CVE-2024-21412Internet Shortcut Files Security Feature Bypass. Listed by CISA on 13 February 2024, release day
- CVE-2024-21351Windows SmartScreen Security Feature Bypass. Listed by CISA on 13 February 2024, release day
- CVE-2024-21410Microsoft Exchange Server Elevation of Privilege. Listed by CISA on 15 February 2024, 2 days after the release
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 72 CVEs |
| On CISA's list of exploited vulnerabilities | 5 CVEs |
| CISA's SSVC exploitation: active | 5 CVEs |
| CISA's SSVC exploitation: proof of concept | 1 CVE |
| CISA's SSVC exploitation: none | 66 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 6 CVEs |
| EPSS 0.10 or more | 9 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2024-21413Microsoft Outlook Remote Code Execution | Active | Patch this weekListed | 9.8 Critical | 0.95 |
| 2 | CVE-2024-21338Windows Kernel Elevation of Privilege | Active | Patch this weekListed | 7.8 High | 0.60 |
| 3 | CVE-2024-21412Internet Shortcut Files Security Feature Bypass | Active | Patch this weekListed | 8.1 High | 0.99 |
| 4 | CVE-2024-21351Windows SmartScreen Security Feature Bypass | Active | Patch soonListed | 7.6 High | 0.28 |
| 5 | CVE-2024-21410Microsoft Exchange Server Elevation of Privilege | Active | Patch soonListed | 9.8 Critical | 0.13 |
| 6 | CVE-2024-21404.NET Denial of Service | Proof of concept | Not on CISA's list | 7.5 High | 0.03 |
| 7 | CVE-2024-21357Windows Pragmatic General Multicast (PGM) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.27 |
| 8 | CVE-2024-21345Windows Kernel Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.20 |
| 9 | CVE-2024-21378Microsoft Outlook Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.11 |
| 10 | CVE-2024-21371Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.11 |
| 11 | CVE-2024-21346Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.04 |
| 12 | CVE-2024-21342Windows DNS Client Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 13 | CVE-2024-21349Microsoft ActiveX Data Objects Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 14 | CVE-2024-21352Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 15 | CVE-2024-21353Microsoft WDAC ODBC Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 16 | CVE-2024-21358Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 17 | CVE-2024-21359Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 18 | CVE-2024-21360Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 19 | CVE-2024-21361Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 20 | CVE-2024-21365Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 21 | CVE-2024-21366Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 22 | CVE-2024-21367Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 23 | CVE-2024-21368Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 24 | CVE-2024-21369Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 25 | CVE-2024-21370Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 26 | CVE-2024-21372Windows OLE Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 27 | CVE-2024-21375Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 28 | CVE-2024-21391Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 29 | CVE-2024-21420Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 30 | CVE-2024-21380Microsoft Dynamics Business Central/NAV Information Disclosure | None | Not on CISA's list | 8.0 High | 0.02 |
| 31 | CVE-2024-21379Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.02 |
| 32 | CVE-2024-21348Internet Connection Sharing (ICS) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 33 | CVE-2024-21386.NET Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 34 | CVE-2024-21356Windows Lightweight Directory Access Protocol (LDAP) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 35 | CVE-2024-21343Windows Network Address Translation (NAT) Denial of Service | None | Not on CISA's list | 5.9 Medium | 0.02 |
| 36 | CVE-2024-21344Windows Network Address Translation (NAT) Denial of Service | None | Not on CISA's list | 5.9 Medium | 0.02 |
| 37 | CVE-2024-21401Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 38 | CVE-2024-21364Microsoft Azure Site Recovery Elevation of Privilege | None | Not on CISA's list | 9.3 Critical | 0.01 |
| 39 | CVE-2024-21376Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution | None | Not on CISA's list | 9.0 Critical | 0.01 |
| 40 | CVE-2024-21403Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege | None | Not on CISA's list | 9.0 Critical | 0.01 |
| 41 | CVE-2024-21350Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 42 | CVE-2024-21395Microsoft Dynamics 365 (on-premises) Cross-site Scripting | None | Not on CISA's list | 8.2 High | 0.01 |
| 43 | CVE-2024-20673Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 44 | CVE-2024-21315Microsoft Defender for Endpoint Protection Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 45 | CVE-2024-21354Microsoft Message Queuing (MSMQ) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 46 | CVE-2024-21363Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 47 | CVE-2024-21384Microsoft Office OneNote Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 48 | CVE-2024-21327Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting | None | Not on CISA's list | 7.6 High | 0.01 |
| 49 | CVE-2024-21328Dynamics 365 Sales Spoofing | None | Not on CISA's list | 7.6 High | 0.01 |
| 50 | CVE-2024-21389Microsoft Dynamics 365 (on-premises) Cross-site Scripting | None | Not on CISA's list | 7.6 High | 0.01 |
| 51 | CVE-2024-21393Microsoft Dynamics 365 (on-premises) Cross-site Scripting | None | Not on CISA's list | 7.6 High | 0.01 |
| 52 | CVE-2024-21394Dynamics 365 Field Service Spoofing | None | Not on CISA's list | 7.6 High | 0.01 |
| 53 | CVE-2024-21396Dynamics 365 Sales Spoofing | None | Not on CISA's list | 7.6 High | 0.01 |
| 54 | CVE-2024-20667Azure DevOps Server Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 55 | CVE-2024-21347Microsoft ODBC Driver Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 56 | CVE-2024-21406Windows Printing Service Spoofing | None | Not on CISA's list | 7.5 High | 0.01 |
| 57 | CVE-2024-21329Azure Connected Machine Agent Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 58 | CVE-2024-21341Windows Kernel Remote Code Execution | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 59 | CVE-2024-20679Azure Stack Hub Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 60 | CVE-2024-20684Windows Hyper-V Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 61 | CVE-2024-21339Windows USB Generic Parent Driver Remote Code Execution | None | Not on CISA's list | 6.4 Medium | 0.01 |
| 62 | CVE-2024-20695Skype for Business Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 63 | CVE-2024-21377Windows DNS Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 64 | CVE-2024-21374Microsoft Teams for Android Information Disclosure | None | Not on CISA's list | 5.0 Medium | 0.01 |
| 65 | CVE-2024-21340Windows Kernel Information Disclosure | None | Not on CISA's list | 4.6 Medium | 0.01 |
| 66 | CVE-2024-21402Microsoft Outlook Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.00 |
| 67 | CVE-2024-21355Microsoft Message Queuing (MSMQ) Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 68 | CVE-2024-21405Microsoft Message Queuing (MSMQ) Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 69 | CVE-2024-21381Microsoft Azure Active Directory B2C Spoofing | None | Not on CISA's list | 6.8 Medium | 0.00 |
| 70 | CVE-2024-21362Windows Kernel Security Feature Bypass | None | Not on CISA's list | 5.5 Medium | 0.00 |
| 71 | CVE-2024-21397Microsoft Azure File Sync Elevation of Privilege | None | Not on CISA's list | 5.3 Medium | 0.00 |
| 72 | CVE-2024-21304Trusted Compute Base Elevation of Privilege | None | Not on CISA's list | 4.1 Medium | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 13 February 2024, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.