CVE-2024-43451
published 2024-11-12CVE-2024-43451: NTLM Hash Disclosure Spoofing Vulnerability NTLM Hash Disclosure Spoofing Vulnerability
medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2024-12-03
Exploited in the wild
EPSS
84.11%
99.7th percentile
NTLM Hash Disclosure Spoofing Vulnerability
NTLM Hash Disclosure Spoofing Vulnerability
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.20826 | 10.0.10240.20826 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.7515 | 10.0.14393.7515 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.6532 | 10.0.17763.6532 |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19044.5131 | 10.0.19044.5131 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.5131 | 10.0.19045.5131 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.4460 | 10.0.22621.4460 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.4460 | 10.0.22631.4460 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.4460 | 10.0.22631.4460 |
| microsoft | windows_11_version_24h2 | >= 10.0.26100.0 < 10.0.26100.2314 | 10.0.26100.2314 |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.27415 | 6.1.7601.27415 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.22966 | 6.0.6003.22966 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.22267 | 6.3.9600.22267 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.7515 | 10.0.14393.7515 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.6532 | 10.0.17763.6532 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.2849 | 10.0.20348.2849 |
| microsoft | windows_server_2025 | >= 10.0.26100.0 < 10.0.26100.2314 | 10.0.26100.2314 |
| msrc | windows_10 | — | — |
| msrc | windows_10_version_1607 | — | — |
| msrc | windows_10_version_1809 | — | — |
| msrc | windows_10_version_21h2 | — | — |
| msrc | windows_10_version_22h2 | — | — |
| msrc | windows_11_version_22h2 | — | — |
| msrc | windows_11_version_23h2 | — | — |
| msrc | windows_11_version_24h2 | — | — |
| msrc | windows_server_2008 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2024-43451 is triggered by minimal user interaction with a malicious .url file: single right-click, delete, or drag/move to another folder — not just opening it. Monitor for SMB (port 445) or WebDAV (port 80) outbound connections initiated by Windows Explorer or shell processes upon .url file interaction. ↗
- →The exploit abuses the MSHTML engine (legacy Internet Explorer component) embedded in modern Windows to silently invoke NTLM authentication via crafted .url files using UNC path format (file://\\<attacker-IP>@<port>\<path>). Detect .url files containing 'file://' URLs pointing to remote UNC paths. ↗
- →Blind Eagle campaigns used .url files with [InternetShortcut] sections containing UNC-style file:// URLs (e.g., file://\\<IP>@80\file\<payload>.exe) to trigger WebDAV requests and download next-stage payloads. Inspect .url file contents for this pattern. ↗
- →The exploit .url file structure includes the registry property key [{009862A0-0000-0000-C000-000000005986}] with Prop3=19,2 or Prop3=19,9. This GUID and property value combination in .url files is a strong indicator of CVE-2024-43451 exploitation. ↗
- →Post-exploitation tools observed in Head Mare campaigns abusing CVE-2024-43451 include Mimikatz, Secretsdump, WMIExec, and SMBExec (Impacket suite). Monitor for these process names and associated command-line activity following .url file interaction. ↗
- →Blind Eagle used HeartCrypt Packer-as-a-Service to pack a .NET PureCrypter variant delivering Remcos RAT as the final payload. Detections for HeartCrypt-packed .NET binaries and Remcos RAT are relevant post-exploitation indicators for this campaign. ↗
- →UAC-0194 (Russian threat actor) delivered phishing emails with .url files exploiting CVE-2024-43451 to install SparkRAT. Monitor for SparkRAT process activity and C2 connections following .url file interaction in Ukrainian-targeted environments.
- ·CVE-2024-43451 affects ALL supported Windows versions including Windows 10/11 and Windows Server 2008 and later. The vulnerability was patched in November 2024 Patch Tuesday; however, unpatched systems remain vulnerable. ↗
- ·The delete and drag-to-folder trigger behaviors are specific to Windows 10/11 (and some Windows 7/8/8.1 configurations), while right-click triggering affects all Windows versions. Detection logic should account for these platform-specific differences. ↗
- ·Since Microsoft patched CVE-2024-43451, the unusual NTLM hash leakage behavior via right-click/delete/drag no longer occurs on patched systems. However, manual user interaction (clicking) can still trigger download and execution of malicious payloads via the .url file mechanism. ↗
- ·The Blind Eagle .url exploit does not directly exploit CVE-2024-43451 for NTLM hash theft, but uses the same .url file mechanism to trigger WebDAV requests (notifying the attacker of file download) and deliver payloads. Defenders should not assume .url-based WebDAV activity is exclusively NTLM-related. ↗
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
cvelistv56.5MEDIUM
vulncheck6.5MEDIUM
cisa6.5MEDIUM
vendor_msrc6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CVEList
NTLM Hash Disclosure Spoofing Vulnerability
cvelistv5·2024-11-12·CVSS 6.5
CVE-2024-43451 [MEDIUM] CWE-73 NTLM Hash Disclosure Spoofing Vulnerability
NTLM Hash Disclosure Spoofing Vulnerability
NTLM Hash Disclosure Spoofing Vulnerability
VulnCheck
Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability
vulncheck·2024·CVSS 6.5
CVE-2024-43451 [MEDIUM] CWE-73 Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability
Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability
Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.
Affected: Microsoft Windows
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Nov; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43451; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.clearskysec.com/0d-vulnerability-exploited-in-the_wild/; https:/
Microsoft
NTLM Hash Disclosure Spoofing Vulnerability
vendor_msrc·2024-11-12·CVSS 6.5
CVE-2024-43451 [MEDIUM] CWE-73 NTLM Hash Disclosure Spoofing Vulnerability
NTLM Hash Disclosure Spoofing Vulnerability
FAQ: According to the CVSS metric, successful exploitation of this vulnerability could lead to total loss of confidentiality (C:H)? What does that mean for this vulnerability?
This vulnerability discloses a user's NTLMv2 hash to the attacker who could use this to authenticate as the user.
FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
Minimal interaction with a malicious file by a user such as selecting (single-click), inspecting (right-click), or performing an action other than opening or executing the file could trigger this vulnerability.
FAQ: The Security Updates table indicates that this vulnerability affects all supported versions of Microsoft Windows. Why are IE Cumula
CISA
Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability
cisa·2024-11-12·CVSS 6.5
CVE-2024-43451 [MEDIUM] CWE-73 Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability
Vulnerability: Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability
Affected: Microsoft Windows
Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43451 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43451
Remediation Due Date: 2024-12-03
Suricata
ET EXPLOIT NTLM Hash Disclosure via InternetShortcut File Inbound with UNC Path Inbound (CVE-2024-43451)
suricata·2025-05-13·CVSS 6.5
CVE-2024-43451 [MEDIUM] ET EXPLOIT NTLM Hash Disclosure via InternetShortcut File Inbound with UNC Path Inbound (CVE-2024-43451)
ET EXPLOIT NTLM Hash Disclosure via InternetShortcut File Inbound with UNC Path Inbound (CVE-2024-43451)
Rule: alert tcp any any -> $HOME_NET any (msg:"ET EXPLOIT NTLM Hash Disclosure via InternetShortcut File Inbound with UNC Path Inbound (CVE-2024-43451)"; flow:established,to_client; file.data; content:"|5b|InternetShortcut"; fast_pattern; pcre:"/^(?:\x2e[AW])\x5d/R"; content:"|3d 5c 5c 5c 5c|"; reference:url,research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/; reference:cve,2024-43451; classtype:attempted-user; sid:2062313; rev:1; metadata:attack_target Client_Endpoint, created_at 2025_05_13, cve CVE_2024_43451, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2025_05_13
No public exploits indexed.
Securelist
Old tech, new vulnerabilities: NTLM abuse, ongoing exploitation in 2025
blogs_securelist·2025-11-26·CVSS 6.5
CVE-2024-43451 [MEDIUM] Old tech, new vulnerabilities: NTLM abuse, ongoing exploitation in 2025
Table of Contents
Just like the 2000s
How NTLM authentication works
NTLM is dead — long live NTLM
Persistent threats in NTLM-based authentication
Hash leakage
Coercion-based attacks
Credential forwarding
Man-in-the-Middle (MitM) attacks
NTLM exploitation in 2025
CVE-2024‑43451
BlindEagle campaign delivering Remcos RAT via CVE-2024-43451
Head Mare campaigns against Russian targets abusing CVE-2024-43451
CVE-2025-24054/CVE-2025-24071
Trojan distribution in Russia via CVE-2025-24054
CVE-2025-33073
Suspicious activity in Uzbekistan involving CVE-2025-33073
Protection and recommendations
Disable/Limit NTLM
Implement message signing
Enable Extended Protection for Authentication (EPA)
Monitor and audit NTLM traffic and authentication logs
Conclusions
Authors
Leandro Cuozzo
Securelist
How NTLM is being abused in 2025 cyberattacks
blogs_securelist·2025-11-26
How NTLM is being abused in 2025 cyberattacks
Table of Contents
- Just like the 2000s
- How NTLM authentication works
- NTLM is dead — long live NTLM
- Persistent threats in NTLM-based authentication
- NTLM exploitation in 2025
- Protection and recommendations
- Conclusions
Authors
- Leandro Cuozzo
## Just like the 2000s
Flip phones grew popular, Windows XP debuted on personal computers, Apple introduced the iPod, peer-to-peer file sharing via torrents was taking off, and MSN Messenger dominated online chat. That was the tech scene in 2001, the same year when Sir Dystic of Cult of the Dead Cow published SMBRelay, a proof-of-concept that brought NTLM relay attacks out of theory and into practice, demonstrating a powerful new class of authentication relay exploits.
Ever since that distant 2001, the weaknesses of the NTLM authenti
Checkpoint
CVE-2025-24054, NTLM Exploit in the Wild
blogs_checkpoint·2025-04-16·CVSS 5.4
CVE-2025-24054 [MEDIUM] CVE-2025-24054, NTLM Exploit in the Wild
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## CVE-2025-24054, NTLM Exploit in the Wild
## Key Points
.library-ms
Around March 20–21, 2025 , a campaign targeted government and private institutions in Poland and Romania . Attackers u
Checkpoint
17th March – Threat Intelligence Report
blogs_checkpoint·2025-03-17
CVE-2025-24983 17th March – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 17th March – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 17th March, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Check Point Research elaborates about the pro-Palestinian hacktivist group “Dark Storm” which claimed the large-scale DDoS attack against X (formerly Twitter). The attack disrupted access to the platform, causing outages for users worldwide. Recently, Dark Storm was also targeting Western organizations and critical infrastruc
Checkpoint
Blind Eagle: …And Justice for All
blogs_checkpoint·2025-03-10·CVSS 6.5
CVE-2024-43451 [MEDIUM] Blind Eagle: …And Justice for All
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Blind Eagle: …And Justice for All
## Key Points
.url
CVE-2024-43451 exposes a user’s NTLMv2 hash, which can allow an attacker to authenticate as the user via pass-the-hash or relay atta
Securelist
Vulnerability landscape analysis for Q4 2024
blogs_securelist·2025-02-26
Vulnerability landscape analysis for Q4 2024
Table of Contents
- Statistics on registered vulnerabilities
- Exploitation statistics
- Vulnerability exploitation in APT attacks
- Interesting vulnerabilities
- Conclusion and advice
Authors
- Alexander Kolesnikov
Q4 2024 saw fewer published exploits for Windows and Linux compared to the first three quarters. Although the number of registered vulnerabilities continued to rise, the total number of Proof of Concept (PoC) instances decreased compared to 2023. Among notable techniques in Q4, attackers leveraged undocumented RPC interfaces and targeted the Windows authentication mechanism.
## Statistics on registered vulnerabilities
This section contains statistics on registered vulnerabilities. Data is sourced from the CVE portal: cve.org.
Total number of registered vulnerabilities a
Securelist
Exploits and vulnerabilities in Q4 2024
blogs_securelist·2025-02-26·CVSS 6.5
CVE-2024-43572 [MEDIUM] Exploits and vulnerabilities in Q4 2024
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most common published exploits
Vulnerability exploitation in APT attacks
Interesting vulnerabilities
CVE-2024-43572—Remote code execution vulnerability in Microsoft Management Console
CVE-2024-43451—NetNTLM hash disclosure vulnerability
CVE-2024-49039—Elevation of privilege vulnerability in Windows Task Scheduler
Conclusion and advice
Authors
Alexander Kolesnikov
Q4 2024 saw fewer published exploits for Windows and Linux compared to the first three quarters. Although the number of registered vulnerabilities continued to rise, the total number of Proof of Concept (PoC) instances decreased compared to 2023. Among notable techniques in Q4, attackers leve
Tenable
Microsoft Patch Tuesday 2024 Year in Review
blogs_tenable·2024-12-10
Microsoft Patch Tuesday 2024 Year in Review
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Checkpoint
18th November – Threat Intelligence Report
blogs_checkpoint·2024-11-18
CVE-2024-43451 18th November – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 18th November – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 11th November, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
The FBI and CISA issued a joint statement detailing a major Chinese cyber-espionage campaign targeting U.S. telecommunications infrastructure, led by the APT group Salt Typhoon. This operation compromised networks to steal call records, intercept communications involving government and political figures, and access data
Krebs
Microsoft Patch Tuesday, November 2024 Edition
blogs_krebs·2024-11-13·CVSS 6.5
CVE-2024-49039 [MEDIUM] Microsoft Patch Tuesday, November 2024 Edition
Microsoft today released updates to plug at least 89 security holes in its Windows operating systems and other software. November’s patch batch includes fixes for two zero-day vulnerabilities that are already being exploited by attackers, as well as two other flaws that were publicly disclosed prior to today.
The zero-day flaw tracked as CVE-2024-49039 is a bug in the Windows Task Scheduler that allows an attacker to increase their privileges on a Windows machine. Microsoft credits Google’s Threat Analysis Group with reporting the flaw.
The second bug fixed this month that is already seeing in-the-wild exploitation is CVE-2024-43451, a spoofing flaw that could reveal Net-NTLMv2 hashes, which are used for authentication in Windows environments.
Satnam Narang, senior staff research engine
Bleepingcomputer
Microsoft patches Windows zero-day exploited in attacks on Ukraine
blogs_bleepingcomputer·2024-11-13·CVSS 6.5
[MEDIUM] Microsoft patches Windows zero-day exploited in attacks on Ukraine
## Microsoft patches Windows zero-day exploited in attacks on Ukraine
## Sergiu Gatlan
"When the user interacts with the URL file by right-clicking, deleting, or moving it, the vulnerability is triggered," ClearSky said .
When this happens, a connection to a remote server is created to download malware payloads, including the SparkRAT open-source and multi-platform remote access tool that enables attackers to control compromised systems remotely.
While investigating the incident, the researchers were also alerted of an attempt to steal an NTLM hash via the Server Message Block (SMB) protocol. These password hashes can be used in " pass-the-hash " attacks or cracked to get a user's plaintext password.
ClearSky shared this information with Ukraine's Computer Emergency Response Team (CER
Qualys
November 2024 Patch Tuesday Updates for Microsoft & Adobe | Qualys
blogs_qualys·2024-11-12·CVSS 6.5
[MEDIUM] November 2024 Patch Tuesday Updates for Microsoft & Adobe | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for November 2024
- Adobe Patches for November 2024
- Zero-day Vulnerabilities Patched in November Patch Tuesday Edition
- Critical Severity Vulnerabilities Patched in November Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- Qualys Monthly Webinar Series
Microsoft has released its November 2024 Patch Tuesday updates, targeting various vulnerabilities that could impact users and organizations worldwide. From zero-day threats to key product patches, here’s what’s crucial to apply this mont
Talos
November Patch Tuesday release contains three critical remote code execution vulnerabilities
blogs_talos·2024-11-12·CVSS 9.8
CVE-2024-43639 [CRITICAL] November Patch Tuesday release contains three critical remote code execution vulnerabilities
The Patch Tuesday for November of 2024 includes 89 vulnerabilities, including four that Microsoft marked as “critical.” The remaining vulnerabilities listed are classified as “important.”
Microsoft assessed that exploitation of the four “critical” vulnerabilities is “less likely.”
CVE-2024-43639 is a remote code execution vulnerability in Windows Kerberos that could be exploited by an attacker by creating a specially crafted application to leverage a vulnerable cryptographic protocol. While considered “critical” it was determined that exploitation is “less likely” and not been detected in the wild.
CVE-2024-43625 is a privilege escalation vulnerability in a VMSwitch driver, which is a networking component of Hyper-V. An attacker could exploit this by sending a specific series of network
Krebs
Microsoft Patch Tuesday, November 2024 Edition
blogs_krebs·2024-11-12·CVSS 6.5
CVE-2024-49039 [MEDIUM] Microsoft Patch Tuesday, November 2024 Edition
Microsoft today released updates to plug at least 89 security holes in its Windows operating systems and other software. November’s patch batch includes fixes for two zero-day vulnerabilities that are already being exploited by attackers, as well as two other flaws that were publicly disclosed prior to today.
The zero-day flaw tracked as CVE-2024-49039 is a bug in the Windows Task Scheduler that allows an attacker to increase their privileges on a Windows machine. Microsoft credits Google’s Threat Analysis Group with reporting the flaw.
The second bug fixed this month that is already seeing in-the-wild exploitation is CVE-2024-43451 , a spoofing flaw that could reveal Net-NTLMv2 hashes , which are used for authentication in Windows environments.
Satnam Narang , senior staff research eng
Bleepingcomputer
Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 89 flaws
blogs_bleepingcomputer·2024-11-12·CVSS 6.5
[MEDIUM] Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 89 flaws
## Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 89 flaws
## Lawrence Abrams
26 Elevation of Privilege vulnerabilities
2 Security Feature Bypass vulnerabilities
52 Remote Code Execution vulnerabilities
1 Information Disclosure vulnerability
4 Denial of Service vulnerabilities
3 Spoofing vulnerabilities
This count does not include two Edge flaws that were previously fixed on November 7th.
To learn more about the non-security updates released today, you can review our dedicated articles on the new Windows 11 KB5046617 and KB5046633 cumulative updates and the Windows 10 KB5046613 update .
## Four zero-days disclosed
This month's Patch Tuesday fixes four zero-days, two of which were actively exploited in attacks, and three were publicly disclosed.
Microsoft classifies a
Qualys
Microsoft and Adobe Patch Tuesday, November 2024 Security Update Review
blogs_qualys·2024-11-12·CVSS 6.5
[MEDIUM] Microsoft and Adobe Patch Tuesday, November 2024 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for November 2024
Adobe Patches for November 2024
Zero-day Vulnerabilities Patched in November Patch Tuesday Edition
Critical Severity Vulnerabilities Patched in November Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
Qualys Monthly Webinar Series
Microsoft has released its November 2024 Patch Tuesday updates, targeting various vulnerabilities that could impact users and organizations worldwide. From zero-day threats to key product patches, here’s what’s crucial to apply this month. Here’s a b
Talos
November Patch Tuesday release contains three critical remote code execution vulnerabilities
blogs_talos·2024-11-12·CVSS 9.8
CVE-2024-43639 [CRITICAL] November Patch Tuesday release contains three critical remote code execution vulnerabilities
## November Patch Tuesday release contains three critical remote code execution vulnerabilities
The Patch Tuesday for November of 2024 includes 89 vulnerabilities, including four that Microsoft marked as “critical.” The remaining vulnerabilities listed are classified as “important.”
Microsoft assessed that exploitation of the four “critical” vulnerabilities is “less likely.”
CVE-2024-43639 is a remote code execution vulnerability in Windows Kerberos that could be exploited by an attacker by creating a specially crafted application to leverage a vulnerable cryptographic protocol. While considered “critical” it was determined that exploitation is “less likely” and not been detected in the wild.
CVE-2024-43625 is a privilege escalation vulnerability in a VMSwitch driver, which is a networ
Tenable
Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039)
blogs_tenable·2024-11-12·CVSS 6.5
[MEDIUM] Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Threat Intel
UAC-0194
threat_intel·CVSS 6.5
CVE-2024-43451 [MEDIUM] UAC-0194
# Threat Actor: UAC-0194
## Description
UAC-0194 is a Russian threat actor linked to the exploitation of the Windows zero-day CVE-2024-43451, which was used in attacks against Ukrainian organizations. The group delivered phishing emails containing .url files that, when interacted with, exploited the vulnerability to facilitate the installation of additional payloads, including the SparkRAT trojan. They also exploited the Server Message Block protocol for NTLM hash exfiltration. CERT-UA has associated UAC-0194's activities with social engineering tactics to convince victims to execute malicious files.
Crowdstrike
November 2024 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] November 2024 Patch Tuesday: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
2024-11-12
Published
2024-11-12
Added to CISA KEV
Exploited in the wild