CVE-2024-49091

published 2024-12-12

CVE-2024-49091: Windows Domain Name Service Remote Code Execution Vulnerability

Priority P3 47 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

Windows Domain Name Service Remote Code Execution Vulnerability

Affected

19 ranges

Vendor	Product	Version range	Fixed in
microsoft	windows_server_2012	—	—
microsoft	windows_server_2012	>= 6.2.9200.0 < 6.2.9200.25222	6.2.9200.25222
microsoft	windows_server_2012_r2	>= 6.3.9600.0 < 6.3.9600.22318	6.3.9600.22318
microsoft	windows_server_2016	< 10.0.14393.7606	10.0.14393.7606
microsoft	windows_server_2016	>= 10.0.14393.0 < 10.0.14393.7606	10.0.14393.7606
microsoft	windows_server_2019	< 10.0.17763.6659	10.0.17763.6659
microsoft	windows_server_2019	>= 10.0.17763.0 < 10.0.17763.6659	10.0.17763.6659
microsoft	windows_server_2022	< 10.0.20348.2966	10.0.20348.2966
microsoft	windows_server_2022	>= 10.0.20348.0 < 10.0.20348.2966	10.0.20348.2966
microsoft	windows_server_2022_23h2	< 10.0.25398.1308	10.0.25398.1308
microsoft	windows_server_2025	< 10.0.26100.2605	10.0.26100.2605
microsoft	windows_server_2025	>= 10.0.26100.0 < 10.0.26100.2605	10.0.26100.2605
msrc	windows_server_2012	—	—
msrc	windows_server_2012_r2	—	—
msrc	windows_server_2016	—	—
msrc	windows_server_2019	—	—
msrc	windows_server_2022	—	—
msrc	windows_server_2022_23h2_edition	—	—
msrc	windows_server_2025	—	—

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vendor_msrc 7.2 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-591