Microsoft starts off new year with relatively light Patch Tuesday, no zero-days
Summary: Microsoft disclosed 48 vulnerabilities in its January 2024 Patch Tuesday release, 46 rated "important" and two rated critical, with no zero-days. The critical issues are CVE-2024-20674, a Windows Kerberos security bypass allowing a man-in-the-middle attacker to spoof the authentication server, and CVE-2024-20700, a Windows Hyper-V remote code execution flaw requiring an attacker to win a race condition after gaining access to a restricted network.
What you should know: Microsoft rates the Kerberos bypass as "more likely" to be exploited because Kerberos is present on several of the most popular operating systems, so the authentication server your environment trusts is the target.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-20674CVE-2024-20698CVE-2024-20700CVE-2024-21307CVE-2024-21318
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026