Microsoft · ServicingStack update · October 8, 2024

KB5044284: October 2024 cumulative update for Windows Server 23H2

KB5044284, released October 8, 2024, fixes 64 CVEs across 2 products. 2 of them are being exploited (CVE-2024-43572); 2 on CISA KEV. Patch Radar priority: Patch now.

Patch now2 on CISA KEV4 publicly disclosed
CVEs closed
64
1 rated Critical
Exploited
2
CVE-2024-43572
Exploitation more likely
5
Microsoft's assessment
Highest EPSS
0.6670
99th percentile

Priority of the 64 CVEs

Patch now 2 Urgent 6 High 27 Routine 29

Applies to

ProductBuild after install
Windows 11 Version 24H2 for ARM64-based Systems26100.2033
Windows 11 Version 24H2 for x64-based Systems26100.2033

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2024-43572 Microsoft Management ConsoleRemote Code Execution7.8 0.6670 KEVDisclosedExploited
Patch now CVE-2024-43573 Windows MSHTML PlatformSpoofing6.5 0.4611 KEVDisclosedExploited
Urgent CVE-2024-43560 Windows Storage Port DriverElevation of Privilege7.8 0.0357 More likely
Urgent CVE-2024-43582 Windows Remote DesktopRemote Code Execution8.1 0.0316 Exploitation Less Likely
Urgent CVE-2024-43581 OpenSSH for WindowsRemote Code Execution7.1 0.0140 More likely
Urgent CVE-2024-43615 OpenSSH for WindowsRemote Code Execution7.1 0.0124 More likely
Urgent CVE-2024-43556 Microsoft Graphics ComponentElevation of Privilege7.8 0.0072 More likely
Urgent CVE-2024-43509 Microsoft Graphics ComponentElevation of Privilege7.8 0.0064 More likely
High CVE-2024-43532 RPC Endpoint Mapper ServiceElevation of Privilege8.8 0.1197 Exploitation Less Likely
High CVE-2024-6197 Windows cURL ImplementationRemote Code Execution8.8 0.0430 DisclosedExploitation Less Likely
High CVE-2024-43506 BranchCacheDenial of Service7.5 0.0230 Exploitation Less Likely
High CVE-2024-43515 Internet Small Computer Systems Interface (iSCSI)Denial of Service7.5 0.0226 Exploitation Less Likely
High CVE-2024-43562 Windows Network Address Translation (NAT)Denial of Service7.5 0.0222 Exploitation Less Likely
High CVE-2024-43565 Windows Network Address Translation (NAT)Denial of Service7.5 0.0222 Exploitation Less Likely
High CVE-2024-38149 BranchCacheDenial of Service7.5 0.0221 Exploitation Less Likely
High CVE-2024-43533 Remote Desktop ClientRemote Code Execution8.8 0.0159 Exploitation Less Likely
High CVE-2024-43519 Microsoft WDAC OLE DB provider for SQLRemote Code Execution8.8 0.0150 Exploitation Less Likely
High CVE-2024-43599 Remote Desktop ClientRemote Code Execution8.8 0.0144 Exploitation Less Likely
High CVE-2024-43517 Microsoft ActiveXRemote Code Execution8.8 0.0144 Exploitation Less Likely
High CVE-2024-43574 Microsoft Windows SpeechRemote Code Execution8.3 0.0117 Exploitation Less Likely
High CVE-2024-43550 Windows Secure ChannelSpoofing7.4 0.0109 Exploitation Less Likely
High CVE-2024-43518 Windows Telephony ServerRemote Code Execution8.8 0.0099 Exploitation Less Likely
High CVE-2024-20659 Role: Windows Hyper-VSecurity Feature Bypass7.1 0.0094 DisclosedExploitation Less Likely
High CVE-2024-43529 Windows Print Spooler ComponentsElevation of Privilege7.3 0.0082 Exploitation Less Likely
High CVE-2024-43552 Windows ShellRemote Code Execution7.3 0.0076 Exploitation Less Likely
Showing 1 to 25 of 64 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.