Another Patch Tuesday with no zero-days, only two critical vulnerabilities disclosed by Microsoft
Summary: Microsoft's March 2024 Patch Tuesday contained 60 vulnerabilities, only two labeled critical, and no actively exploited flaws for the second month in a row. Both critical issues are in Windows Hyper-V: CVE-2024-21408, a denial-of-service flaw scored 5.5 that could let an adversary target a host from inside a VM, and CVE-2024-21407, a remote code execution flaw requiring the attacker to be authenticated in the VM and gather specific environment information first.
Key Takeaway: The highest CVSS score in the release, 9.8, belongs to CVE-2024-21334, a use-after-free in Open Management Infrastructure that a remote, unauthenticated attacker could trigger over the internet - yet Microsoft rated it only important, so severity labels alone will not tell you what to patch first.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-21334CVE-2024-21407CVE-2024-21408
- Related
- Patch Tuesday, March 2024 Edition Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026