Microsoft issued an urgent warning on Tuesday about an actively exploited zero-day vulnerability in the Windows Management Console, used for system configuration and monitoring.
See also: Rackspace: Data stolen due to ScienceLogic zero-day
The zero-day, labeled CVE-2024-43572, is documented as a remote code execution issue in the Windows Management Console (MMC), a frequently targeted component of the Windows.
The company's security response team warned that attackers are exploiting malicious Microsoft Saved Console (MSC) files to execute remote code on targeted Windows systems
The flaw has a CVSS severity rating of 7.8/10 and is part of Patch Tuesday, which covers at least 119 documented vulnerabilities across the Windows ecosystem.
As is customary, Microsoft did not share IOCs (indicators of compromise) or other telemetry data to help security researchers look for signs of infections.
See also: Windows vulnerability abused by Void Banshee in zero-day attacks
This is the 23rd time this year that Microsoft has been forced to respond to a zero-day before patches are available.
A zero-day vulnerability, such as the one in the Windows Management Console, refers to a software flaw that is unknown to those responsible for patching or mitigating it, and is often exploited by malicious actors before a fix is available. Such vulnerabilities are particularly dangerous because there is no time (“zero days”) for developers to address the issue before it is exploited. They often require immediate attention, as they can be used to launch attacks that compromise sensitive data or systems.
See also: Microsoft fixes zero-day in Windows Smart App Control
Organizations are advised to adopt proactive security strategies to mitigate the risks associated with zero-day vulnerabilities. This includes implementing comprehensive threat detection systems that can identify unusual activities, as well as conducting regular audits and penetration tests to uncover potential weaknesses in their security frameworks. In addition, cultivating a culture of security awareness among employees can further help prevent unintended actions that could expose systems to exploitation.
Source: securityweek
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
