Microsoft Patch Tuesday, September 2024: the CVEs

Microsoft Patch Tuesday September 2024: the CVEs Microsoft published on 10 September 2024, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Aug 2024, Jul 2024, Jun 2024, May 2024, Apr 2024, Mar 2024, Feb 2024, Jan 2024, Dec 2023, Nov 2023, Oct 2023, Sep 2023. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 9.8CVE-2024-43491EPSS 13%2024-09-10

   Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, version 1507 (initial version released July 2015). This means that an attacker co…

2. 9.8CVE-2024-43455EPSS 1.7%2024-09-10

   Windows Remote Desktop Licensing Service Spoofing Vulnerability

3. 9.8CVE-2024-38240EPSS 1.5%2024-09-10

   Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

4. 9.8CVE-2024-38225EPSS 1.4%2024-09-10

   Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

5. 9.0CVE-2024-38220EPSS 1.0%2024-09-10

   Azure Stack Hub Elevation of Privilege Vulnerability

6. 9.0CVE-2024-38216EPSS 0.9%2024-09-10

   Azure Stack Hub Elevation of Privilege Vulnerability

7. 9.9CVE-2024-38194EPSS 1.3%2024-09-10

   An authenticated attacker can exploit an improper authorization vulnerability in Azure Web Apps to elevate privileges over a network.

8. 9.8CVE-2024-37980EPSS 1.4%2024-09-10

   Microsoft SQL Server Elevation of Privilege Vulnerability

9. 9.8CVE-2024-37341EPSS 1.4%2024-09-10

   Microsoft SQL Server Elevation of Privilege Vulnerability

10. 9.8CVE-2024-21416EPSS 1.4%2024-09-10

    Windows TCP/IP Remote Code Execution Vulnerability