The November 2024 Patch Tuesday adresses 91 vulnerabilities, including 4 zero-day ones

The November 2024 Patch Tuesday security updates have fixed 91 flaws, which include 4 zero-day vulnerabilities. As with most Patch Tuesday releases, November’s updates include fixes for Windows, Office, .NET, Visual Studio, SQL Server, and more vulnerabilities.

This month’s fixes list includes:

• 26 elevations of privilege vulnerabilities
• 2 security feature bypass vulnerabilities
• 52 remote code execution vulnerabilities
• 1 information disclosure vulnerability
• 4 denial of service vulnerabilities
• 3 spoofing vulnerabilities

Two of the zero-days fixed today are actively exploited in attacks, and the third was publicly disclosed but not exploited.

CVE-2024-43451 – NTLM Hash Disclosure Spoofing Vulnerability

This vulnerability discloses a user’s NTLMv2 hash to the attacker who could use this to authenticate as the user. Minimal interaction with a malicious file by a user such as selecting (single-click), inspecting (right-click), or performing an action other than opening or executing could trigger this vulnerability.

CVE-2024-49039 – Windows Task Scheduler Elevation of Privilege Vulnerability

In this case, a successful attack could be performed from a low privilege AppContainer. The attacker could elevate their privileges and execute code or access resources at a higher integrity level than that of the AppContainer execution environment.

CVE-2024-49040 – Microsoft Exchange Server Spoofing Vulnerability

Microsoft is aware of a vulnerability (CVE-2024-49040) that allows attackers to run spoofing attacks against Microsoft Exchange Server. The vulnerability is caused by the current implementation of the P2 FROM header verification, which happens in transport.

CVE-2024-49019 – Active Directory Certificate Services Elevation of Privilege Vulnerability

Check if you have published any certificates created using a version 1 certificate template where the Source of subject name is set to “Supplied in the request” and the Enroll permissions are granted to a broader set of accounts, such as domain users or domain computers. An example is the built-in Web Server template, but it is not vulnerable by default due to its restricted Enroll permissions.

Here’s the complete list of all the vulnerabilities Microsoft addresses with the November 2024 Patch Tuesday update.

In addition to the above vulnerabilities, Microsoft has also fixed a bug in Windows that caused blue screens on Windows Server 2025 devices. The problem would occur during backups or deduplication jobs.

Furthermore, a new update for Microsoft Exchange Server 2025 adds a warning to emails that could be abusing the CVE-2024-49040 vulnerability.

Microsoft released the November 2024 Patch Tuesday updates for Windows 10 and Windows 11, managing to fix some frustrating issues on these operating systems.

Windows users can get the November 2024 Patch Tuesday updates via Windows Update, Microsoft Update, or downloading them from the Microsoft Update Catalog website.