Largest Patch Tuesday since July includes two exploited in the wild, three critical vulnerabilities
Summary: Microsoft's October Patch Tuesday fixed 117 CVEs, the most since July's 142, including two vulnerabilities exploited in the wild and three critical remote code execution flaws. The exploited pair are CVE-2024-43572, a remote code execution flaw in Microsoft Management Console addressed by blocking untrusted MSC files, and CVE-2024-43573, a Windows MSHTML platform spoofing vulnerability; both are rated moderate severity.
What's compelling: The two flaws attackers are already using carry only a moderate rating, so severity scores alone would not have prioritized them. Separately, CVE-2024-43468 in Microsoft Configuration Manager scores 9.8 out of 10 and lets an attacker run commands on the targeted server or its underlying database.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-43468CVE-2024-43488CVE-2024-43572CVE-2024-43573CVE-2024-43582CVE-2024-43583
- Related
- Patch Tuesday, October 2024 Edition Cyber Risks ·CVE-2024-43468: Microsoft Configuration Manager SQL Injection Vulnerability Known Exploited Vulnerabilities · Feb 12, 2026