November 2024 Patch Tuesday Fixes 91 Vulnerabilities, Featuring 4 Zero-Day Issues

During Patch Tuesday in November 2024, Microsoft addressed a total of 91 vulnerabilities, which notably included four zero-day flaws. In line with the usual Patch Tuesday procedure, this month’s updates provide vital security patches for various systems, such as Windows, Microsoft Office,. NET, Visual Studio, and SQL Server, among others.

This month’s update encompasses the following categories of vulnerabilities:

• 26 vulnerabilities related to elevation of privilege
• 2 vulnerabilities that allow bypassing security features
• 52 vulnerabilities that enable remote code execution
• 1 vulnerability resulting in information disclosure
• 4 vulnerabilities causing denial of service
• 3 vulnerabilities associated with spoofing

Out of the four zero-day vulnerabilities that have been patched, two had already been exploited in active attacks while the third was disclosed to the public without confirmed exploitation.

CVE-2024-43451 – NTLM Hash Disclosure Spoofing Vulnerability

CVE-2024-49039 – Windows Task Scheduler Elevation of Privilege Vulnerability

CVE-2024-49040 – Microsoft Exchange Server Spoofing Vulnerability

CVE-2024-49019 – Active Directory Certificate Services Elevation of Privilege Vulnerability

Below is a detailed list of all vulnerabilities addressed by Microsoft in the November 2024 Patch Tuesday update.

Additionally, Microsoft resolved an issue in Windows that resulted in blue screen errors on Windows Server 2025 during backup or deduplication processes. A recent update for Microsoft Exchange Server 2025 has also introduced a caution for emails that might exploit the CVE-2024-49040 vulnerability.

Users of Windows 10 and Windows 11 can obtain the latest November 2024 Patch Tuesday updates through Windows Update, Microsoft Update, or by downloading them directly from the Microsoft Update Catalog.

If you have issued any certificates based on a version 1 certificate template where the subject name is set to “Supplied in the request” and enrollment permissions are extended to a wide array of accounts (like domain users or computers), please review them. The built-in Web Server template is one such example, although it is not vulnerable by default because of its limited Enroll permissions.

Microsoft acknowledges the existence of a vulnerability (CVE-2024-49040) that makes it feasible for attackers to carry out spoofing attacks targeting Microsoft Exchange Server. This vulnerability stems from the current method of validation for the P2 FROM header during transmission.

A successful breach via this method could be conducted from a low-privilege AppContainer. This would allow attackers to elevate their permissions and execute code or access resources at a higher integrity level than the AppContainer’s execution environment permits.

This vulnerability can disclose a user’s NTLMv2 hash to attackers, who may then authenticate as that user. A user’s minimal interaction with a harmful file—such as clicking, right-clicking to inspect, or performing actions other than executing—may activate this vulnerability.

Source & Images