Microsoft's security release of 11 June 2024
Patch Tuesday, June 2024
As of , CISA lists two of the 49 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2024-35250, Windows Kernel-Mode Driver Elevation of Privilege.
On CISA's list of exploited vulnerabilities
- CVE-2024-35250Windows Kernel-Mode Driver Elevation of Privilege. Listed by CISA on 16 December 2024, 188 days after the release
- CVE-2024-30088Windows Kernel Elevation of Privilege. Listed by CISA on 15 October 2024, 126 days after the release
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 49 CVEs |
| On CISA's list of exploited vulnerabilities | 2 CVEs |
| CISA's SSVC exploitation: active | 2 CVEs |
| CISA's SSVC exploitation: proof of concept | 4 CVEs |
| CISA's SSVC exploitation: none | 43 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 1 CVE |
| EPSS 0.10 or more | 5 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2024-35250Windows Kernel-Mode Driver Elevation of Privilege | Active | Patch this weekListed | 7.8 High | 0.25 |
| 2 | CVE-2024-30088Windows Kernel Elevation of Privilege | Active | Patch this weekListed | 7.0 High | 0.68 |
| 3 | CVE-2024-30085Windows Cloud Files Mini Filter Driver Elevation of Privilege | Proof of concept | Not on CISA's list | 7.8 High | 0.14 |
| 4 | CVE-2024-30103Microsoft Outlook Remote Code Execution | Proof of concept | Not on CISA's list | 8.8 High | 0.03 |
| 5 | CVE-2024-30104Microsoft Office Remote Code Execution | Proof of concept | Not on CISA's list | 7.8 High | 0.02 |
| 6 | CVE-2024-30090Microsoft Streaming Service Elevation of Privilege | Proof of concept | Not on CISA's list | 7.0 High | 0.02 |
| 7 | CVE-2024-30080Microsoft Message Queuing (MSMQ) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.43 |
| 8 | CVE-2024-30087Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.10 |
| 9 | CVE-2024-30089Microsoft Streaming Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.08 |
| 10 | CVE-2024-30084Windows Kernel-Mode Driver Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.06 |
| 11 | CVE-2024-30078Windows Wi-Fi Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.05 |
| 12 | CVE-2024-30091Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.04 |
| 13 | CVE-2024-35249Microsoft Dynamics 365 Business Central Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.03 |
| 14 | CVE-2024-30083Windows Standards-Based Storage Management Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 15 | CVE-2024-30097Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 16 | CVE-2024-30077Windows OLE Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.02 |
| 17 | CVE-2024-30070DHCP Server Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 18 | CVE-2024-30101Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.02 |
| 19 | CVE-2024-35252Azure Storage Movement Client Library Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 20 | CVE-2024-30076Windows Container Manager Service Elevation of Privilege | None | Not on CISA's list | 6.8 Medium | 0.02 |
| 21 | CVE-2024-35263Microsoft Dynamics 365 (On-Premises) Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.02 |
| 22 | CVE-2024-30064Windows Kernel Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 23 | CVE-2024-30068Windows Kernel Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 24 | CVE-2024-37325Azure Science Virtual Machine (DSVM) Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.01 |
| 25 | CVE-2024-30074Windows Link Layer Topology Discovery Protocol Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 26 | CVE-2024-30075Windows Link Layer Topology Discovery Protocol Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 27 | CVE-2024-30062Windows Standards-Based Storage Management Service Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 28 | CVE-2024-30072Microsoft Event Trace Log File Parsing Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 29 | CVE-2024-30082Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 30 | CVE-2024-30086Windows Win32 Kernel Subsystem Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 31 | CVE-2024-30094Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 32 | CVE-2024-30095Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 33 | CVE-2024-30100Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 34 | CVE-2024-30093Windows Storage Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 35 | CVE-2024-30102Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 36 | CVE-2024-35248Microsoft Dynamics 365 Business Central Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 37 | CVE-2024-35254Azure Monitor Agent Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 38 | CVE-2024-30099Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.01 |
| 39 | CVE-2024-29060Visual Studio Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.01 |
| 40 | CVE-2024-30063Windows Distributed File System (DFS) Remote Code Execution | None | Not on CISA's list | 6.7 Medium | 0.01 |
| 41 | CVE-2024-30065Windows Themes Denial of Service | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 42 | CVE-2024-30066Winlogon Elevation of Privilege | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 43 | CVE-2024-30067Winlogon Elevation of Privilege | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 44 | CVE-2024-30096Windows Cryptographic Services Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 45 | CVE-2024-35255Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 46 | CVE-2024-30052Visual Studio Remote Code Execution | None | Not on CISA's list | 4.7 Medium | 0.01 |
| 47 | CVE-2024-30069Windows Remote Access Connection Manager Information Disclosure | None | Not on CISA's list | 4.7 Medium | 0.01 |
| 48 | CVE-2024-35253Microsoft Azure File Sync Elevation of Privilege | None | Not on CISA's list | 4.4 Medium | 0.01 |
| 49 | CVE-2024-35265Windows Perception Service Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 11 June 2024, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.