Microsoft's security release of 10 September 2024
Patch Tuesday, September 2024
As of , CISA lists four of the 79 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2024-43461, Windows MSHTML Platform Spoofing.
On CISA's list of exploited vulnerabilities
- CVE-2024-43461Windows MSHTML Platform Spoofing. Listed by CISA on 16 September 2024, 6 days after the release
- CVE-2024-38217Windows Mark of the Web Security Feature Bypass. Listed by CISA on 10 September 2024, release day
- CVE-2024-38014Windows Installer Elevation of Privilege. Listed by CISA on 10 September 2024, release day
- CVE-2024-38226Microsoft Publisher Security Feature Bypass. Listed by CISA on 10 September 2024, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 79 CVEs |
| On CISA's list of exploited vulnerabilities | 4 CVEs |
| CISA's SSVC exploitation: active | 4 CVEs |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 75 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 2 CVEs |
| EPSS 0.10 or more | 6 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2024-43461Windows MSHTML Platform Spoofing | Active | Patch this weekListed | 8.8 High | 0.54 |
| 2 | CVE-2024-38217Windows Mark of the Web Security Feature Bypass | Active | Patch soonListed | 5.4 Medium | 0.10 |
| 3 | CVE-2024-38014Windows Installer Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.06 |
| 4 | CVE-2024-38226Microsoft Publisher Security Feature Bypass | Active | Patch soonListed | 7.3 High | 0.03 |
| 5 | CVE-2024-38018Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.51 |
| 6 | CVE-2024-43464Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 7.2 High | 0.36 |
| 7 | CVE-2024-43454Windows Remote Desktop Licensing Service Remote Code Execution | None | Not on CISA's list | 7.1 High | 0.22 |
| 8 | CVE-2024-43491Microsoft Windows Update Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.13 |
| 9 | CVE-2024-38227Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 7.2 High | 0.08 |
| 10 | CVE-2024-38241Kernel Streaming Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.06 |
| 11 | CVE-2024-38244Kernel Streaming Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.06 |
| 12 | CVE-2024-38258Windows Remote Desktop Licensing Service Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.05 |
| 13 | CVE-2024-43466Microsoft SharePoint Server Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.05 |
| 14 | CVE-2024-38257Microsoft AllJoyn API Information Disclosure | None | Not on CISA's list | 7.5 High | 0.04 |
| 15 | CVE-2024-38228Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 7.2 High | 0.04 |
| 16 | CVE-2024-38237Kernel Streaming WOW Thunk Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.03 |
| 17 | CVE-2024-38242Kernel Streaming Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.03 |
| 18 | CVE-2024-26186Microsoft SQL Server Native Scoring Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 19 | CVE-2024-26191Microsoft SQL Server Native Scoring Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 20 | CVE-2024-37335Microsoft SQL Server Native Scoring Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 21 | CVE-2024-37338Microsoft SQL Server Native Scoring Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 22 | CVE-2024-37339Microsoft SQL Server Native Scoring Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 23 | CVE-2024-37340Microsoft SQL Server Native Scoring Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 24 | CVE-2024-37965Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.02 |
| 25 | CVE-2024-38259Microsoft Management Console Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 26 | CVE-2024-38260Windows Remote Desktop Licensing Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 27 | CVE-2024-43455Windows Remote Desktop Licensing Service Spoofing | None | Not on CISA's list | 8.8 High | 0.02 |
| 28 | CVE-2024-43469Azure CycleCloud Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 29 | CVE-2024-43458Windows Networking Information Disclosure | None | Not on CISA's list | 7.7 High | 0.02 |
| 30 | CVE-2024-38232Windows Networking Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 31 | CVE-2024-38233Windows Networking Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 32 | CVE-2024-38236DHCP Server Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 33 | CVE-2024-43475Microsoft Windows Admin Center Information Disclosure | None | Not on CISA's list | 7.3 High | 0.02 |
| 34 | CVE-2024-38239Windows Kerberos Elevation of Privilege | None | Not on CISA's list | 7.2 High | 0.02 |
| 35 | CVE-2024-37337Microsoft SQL Server Native Scoring Information Disclosure | None | Not on CISA's list | 7.1 High | 0.02 |
| 36 | CVE-2024-37342Microsoft SQL Server Native Scoring Information Disclosure | None | Not on CISA's list | 7.1 High | 0.02 |
| 37 | CVE-2024-37966Microsoft SQL Server Native Scoring Information Disclosure | None | Not on CISA's list | 7.1 High | 0.02 |
| 38 | CVE-2024-38230Windows Standards-Based Storage Management Service Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 39 | CVE-2024-38231Windows Remote Desktop Licensing Service Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 40 | CVE-2024-38220Azure Stack Hub Elevation of Privilege | None | Not on CISA's list | 9.0 Critical | 0.01 |
| 41 | CVE-2024-37341Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 42 | CVE-2024-37980Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 43 | CVE-2024-38225Microsoft Dynamics 365 Business Central Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 44 | CVE-2024-43479Microsoft Power Automate Desktop Remote Code Execution | None | Not on CISA's list | 8.5 High | 0.01 |
| 45 | CVE-2024-38194Azure Web Apps Elevation of Privilege | None | Not on CISA's list | 8.4 High | 0.01 |
| 46 | CVE-2024-38216Azure Stack Hub Elevation of Privilege | None | Not on CISA's list | 8.2 High | 0.01 |
| 47 | CVE-2024-21416Windows TCP/IP Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 48 | CVE-2024-38045Windows TCP/IP Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 49 | CVE-2024-38240Windows Remote Access Connection Manager Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.01 |
| 50 | CVE-2024-30073Windows Security Zone Mapping Security Feature Bypass | None | Not on CISA's list | 7.8 High | 0.01 |
| 51 | CVE-2024-38046PowerShell Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 52 | CVE-2024-38238Kernel Streaming Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 53 | CVE-2024-38243Kernel Streaming Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 54 | CVE-2024-38245Kernel Streaming Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 55 | CVE-2024-38247Windows Graphics Component Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 56 | CVE-2024-38249Windows Graphics Component Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 57 | CVE-2024-38250Windows Graphics Component Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 58 | CVE-2024-38252Windows Win32 Kernel Subsystem Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 59 | CVE-2024-38253Windows Win32 Kernel Subsystem Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 60 | CVE-2024-43457Windows Setup and Deployment Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 61 | CVE-2024-43463Microsoft Office Visio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 62 | CVE-2024-43465Microsoft Excel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 63 | CVE-2024-43474Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 7.6 High | 0.01 |
| 64 | CVE-2024-43476Microsoft Dynamics 365 (on-premises) Cross-site Scripting | None | Not on CISA's list | 7.6 High | 0.01 |
| 65 | CVE-2024-38119Windows Network Address Translation (NAT) Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 66 | CVE-2024-38263Windows Remote Desktop Licensing Service Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 67 | CVE-2024-43467Windows Remote Desktop Licensing Service Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 68 | CVE-2024-43470Azure Network Watcher VM Agent Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 69 | CVE-2024-43495Windows libarchive Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 70 | CVE-2024-38188Azure Network Watcher VM Agent Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 71 | CVE-2024-38246Win32k Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.01 |
| 72 | CVE-2024-38248Windows Storage Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.01 |
| 73 | CVE-2024-38234Windows Networking Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 74 | CVE-2024-38235Windows Hyper-V Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 75 | CVE-2024-43482Microsoft Outlook for iOS Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 76 | CVE-2024-43487Windows Mark of the Web Security Feature Bypass | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 77 | CVE-2024-38254Windows Authentication Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 78 | CVE-2024-38256Windows Kernel-Mode Driver Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 79 | CVE-2024-43492Microsoft AutoUpdate (MAU) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 10 September 2024, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.