Only one critical issue disclosed as part of Microsoft Patch Tuesday

Summary: Microsoft's monthly security update disclosed 49 vulnerabilities across its products, with only one rated critical: CVE-2024-30080, a use-after-free remote code execution flaw in the HTTP handling function of Microsoft Message Queuing (MSMQ) that Microsoft considers more likely to be exploited. The remaining issues are rated important, including an Outlook remote code execution flaw (CVE-2024-30103) that requires valid Exchange credentials and can be triggered via the Preview Pane, and an Azure Monitor agent elevation of privilege flaw (CVE-2024-35254) allowing arbitrary file and folder deletion.
What you should know: The single critical flaw sits in MSMQ, a service many organizations run without watching closely, and Microsoft itself flags it as more likely to be exploited - so the one patch that matters most this month may be the one least likely to be prioritized.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-30063 CVE-2024-30064 CVE-2024-30068 CVE-2024-30077 CVE-2024-30078 CVE-2024-30080 CVE-2024-30082 CVE-2024-30087 CVE-2024-30091 CVE-2024-30103 CVE-2024-35254
Related: Patch Tuesday, June 2024 “Recall” Edition Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026