Microsoft’s initial Patch Tuesday of 2024 brings a total of 47 security fixes, with two vulnerabilities classified as “critical.” The most severe, CVE-2024-20674, impacts Windows Server versions dating back to 2008, as well as Windows 10 and Windows 11. This Kerberos security feature bypass enables an impersonation attack, posing a significant threat with a CVSS score of 9.0. The vulnerability could be exploited by an unauthenticated attacker using a machine-in-the-middle (MITM) attack or local network spoofing to send a malicious Kerberos message, impersonating the authentication server.
Another critical issue is CVE-2024-20700, a remote code execution vulnerability found in Windows Hyper-V. Despite its CVSS score of 7.5, Microsoft deems it critical. Exploiting this vulnerability would be challenging, requiring the attacker to gain access to the restricted network exposing the hypervisor and then winning a race condition. The affected systems include Windows 10, Windows 11, Microsoft Server 2019, and Server 2022, spanning various builds and architectures. The complete list of patches is available on Microsoft’s website.
