Microsoft's security release of 8 October 2024
Patch Tuesday, October 2024
As of , CISA lists three of the 117 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2024-43468, Microsoft Configuration Manager Remote Code Execution.
On CISA's list of exploited vulnerabilities
- CVE-2024-43468Microsoft Configuration Manager Remote Code Execution. Listed by CISA on 12 February 2026, 492 days after the release
- CVE-2024-43572Microsoft Management Console Remote Code Execution. Listed by CISA on 8 October 2024, release day
- CVE-2024-43573Windows MSHTML Platform Spoofing. Listed by CISA on 8 October 2024, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 117 CVEs |
| On CISA's list of exploited vulnerabilities | 3 CVEs |
| CISA's SSVC exploitation: active | 3 CVEs |
| CISA's SSVC exploitation: proof of concept | 1 CVE |
| CISA's SSVC exploitation: none | 113 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 2 CVEs |
| EPSS 0.10 or more | 4 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2024-43468Microsoft Configuration Manager Remote Code Execution | Active | Patch this weekListed | 9.8 Critical | 0.81 |
| 2 | CVE-2024-43572Microsoft Management Console Remote Code Execution | Active | Patch this weekListed | 7.8 High | 0.67 |
| 3 | CVE-2024-43573Windows MSHTML Platform Spoofing | Active | Patch soonListed | 6.5 Medium | 0.46 |
| 4 | CVE-2024-43583Winlogon Elevation of Privilege | Proof of concept | Not on CISA's list | 7.8 High | 0.01 |
| 5 | CVE-2024-43532Remote Registry Service Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.12 |
| 6 | CVE-2024-43504Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.07 |
| 7 | CVE-2024-43502Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.06 |
| 8 | CVE-2024-43560Microsoft Windows Storage Port Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.04 |
| 9 | CVE-2024-43582Remote Desktop Protocol Server Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.03 |
| 10 | CVE-2024-43483.NET, .NET Framework, and Visual Studio Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 11 | CVE-2024-43484.NET, .NET Framework, and Visual Studio Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 12 | CVE-2024-43485.NET and Visual Studio Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 13 | CVE-2024-43533Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 14 | CVE-2024-43592Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 15 | CVE-2024-43593Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 16 | CVE-2024-43611Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 17 | CVE-2024-43591Azure Command Line Integration (CLI) Elevation of Privilege | None | Not on CISA's list | 8.7 High | 0.02 |
| 18 | CVE-2024-38229.NET and Visual Studio Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.02 |
| 19 | CVE-2024-38149BranchCache Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 20 | CVE-2024-43506BranchCache Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 21 | CVE-2024-43515Internet Small Computer Systems Interface (iSCSI) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 22 | CVE-2024-43521Windows Hyper-V Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 23 | CVE-2024-43541Microsoft Simple Certificate Enrollment Protocol Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 24 | CVE-2024-43544Microsoft Simple Certificate Enrollment Protocol Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 25 | CVE-2024-43545Windows Online Certificate Status Protocol (OCSP) Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 26 | CVE-2024-43562Windows Network Address Translation (NAT) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 27 | CVE-2024-43565Windows Network Address Translation (NAT) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 28 | CVE-2024-43567Windows Hyper-V Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 29 | CVE-2024-43575Windows Hyper-V Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 30 | CVE-2024-43481Power BI Report Server Spoofing | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 31 | CVE-2024-43512Windows Standards-Based Storage Management Service Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 32 | CVE-2024-43534Windows Graphics Component Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 33 | CVE-2024-43609Microsoft Office Spoofing | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 34 | CVE-2024-38124Windows Netlogon Elevation of Privilege | None | Not on CISA's list | 9.0 Critical | 0.01 |
| 35 | CVE-2024-38212Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 36 | CVE-2024-38265Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 37 | CVE-2024-43453Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 38 | CVE-2024-43488Visual Studio Code extension for Arduino Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 39 | CVE-2024-43517Microsoft ActiveX Data Objects Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 40 | CVE-2024-43518Windows Telephony Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 41 | CVE-2024-43519Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 42 | CVE-2024-43549Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 43 | CVE-2024-43564Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 44 | CVE-2024-43589Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 45 | CVE-2024-43599Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 46 | CVE-2024-43607Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 47 | CVE-2024-43608Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 48 | CVE-2024-43497DeepSpeed Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 49 | CVE-2024-43574Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution | None | Not on CISA's list | 8.3 High | 0.01 |
| 50 | CVE-2024-30092Windows Hyper-V Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 51 | CVE-2024-38261Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 52 | CVE-2024-43501Windows Common Log File System Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 53 | CVE-2024-43503Microsoft SharePoint Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 54 | CVE-2024-43505Microsoft Office Visio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 55 | CVE-2024-43509Windows Graphics Component Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 56 | CVE-2024-43514Windows Resilient File System (ReFS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 57 | CVE-2024-43516Windows Secure Kernel Mode Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 58 | CVE-2024-43527Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 59 | CVE-2024-43528Windows Secure Kernel Mode Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 60 | CVE-2024-43551Windows Storage Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 61 | CVE-2024-43556Windows Graphics Component Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 62 | CVE-2024-43601Visual Studio Code for Linux Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 63 | CVE-2024-43616Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 64 | CVE-2024-43584Windows Scripting Engine Security Feature Bypass | None | Not on CISA's list | 7.7 High | 0.01 |
| 65 | CVE-2024-38029Microsoft OpenSSH for Windows Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 66 | CVE-2024-38129Windows Kerberos Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 67 | CVE-2024-38262Windows Remote Desktop Licensing Service Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 68 | CVE-2024-43550Windows Secure Channel Spoofing | None | Not on CISA's list | 7.4 High | 0.01 |
| 69 | CVE-2024-43529Windows Print Spooler Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 70 | CVE-2024-43552Windows Shell Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 71 | CVE-2024-20659Windows Hyper-V Security Feature Bypass | None | Not on CISA's list | 7.1 High | 0.01 |
| 72 | CVE-2024-38097Azure Monitor Agent Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 73 | CVE-2024-43581Microsoft OpenSSH for Windows Remote Code Execution | None | Not on CISA's list | 7.1 High | 0.01 |
| 74 | CVE-2024-43615Microsoft OpenSSH for Windows Remote Code Execution | None | Not on CISA's list | 7.1 High | 0.01 |
| 75 | CVE-2024-43535Windows Kernel-Mode Driver Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.01 |
| 76 | CVE-2024-43612Power BI Report Server Spoofing | None | Not on CISA's list | 6.9 Medium | 0.01 |
| 77 | CVE-2024-43523Windows Mobile Broadband Driver Remote Code Execution | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 78 | CVE-2024-43524Windows Mobile Broadband Driver Remote Code Execution | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 79 | CVE-2024-43525Windows Mobile Broadband Driver Remote Code Execution | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 80 | CVE-2024-43526Windows Mobile Broadband Driver Remote Code Execution | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 81 | CVE-2024-43536Windows Mobile Broadband Driver Remote Code Execution | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 82 | CVE-2024-43543Windows Mobile Broadband Driver Remote Code Execution | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 83 | CVE-2024-37976Windows Resume Extensible Firmware Interface Security Feature Bypass | None | Not on CISA's list | 6.7 Medium | 0.01 |
| 84 | CVE-2024-37979Windows Kernel Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.01 |
| 85 | CVE-2024-37982Windows Resume Extensible Firmware Interface Security Feature Bypass | None | Not on CISA's list | 6.7 Medium | 0.01 |
| 86 | CVE-2024-37983Windows Resume Extensible Firmware Interface Security Feature Bypass | None | Not on CISA's list | 6.7 Medium | 0.01 |
| 87 | CVE-2024-43480Azure Service Fabric for Linux Remote Code Execution | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 88 | CVE-2024-43537Windows Mobile Broadband Driver Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 89 | CVE-2024-43538Windows Mobile Broadband Driver Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 90 | CVE-2024-43540Windows Mobile Broadband Driver Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 91 | CVE-2024-43542Windows Mobile Broadband Driver Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 92 | CVE-2024-43547Windows Kerberos Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 93 | CVE-2024-43555Windows Mobile Broadband Driver Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 94 | CVE-2024-43557Windows Mobile Broadband Driver Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 95 | CVE-2024-43558Windows Mobile Broadband Driver Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 96 | CVE-2024-43559Windows Mobile Broadband Driver Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 97 | CVE-2024-43561Windows Mobile Broadband Driver Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 98 | CVE-2024-43513BitLocker Security Feature Bypass | None | Not on CISA's list | 6.4 Medium | 0.01 |
| 99 | CVE-2024-43604Outlook for Android Elevation of Privilege | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 100 | CVE-2024-43546Windows Cryptographic Information Disclosure | None | Not on CISA's list | 5.6 Medium | 0.01 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 8 October 2024, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.