CVE-2024-49039KEV · OVERDUECWE-287

Microsoft Windows Task Scheduler Privilege Escalation Vulnerability

High · published November 12, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 96.6th percentile for exploit probability.

689
days past CISA
deadline
CVSS v3.1
8.8
EPSS
14%
Percentile
96.6
In the wild
Confirmed
What it is

🚨 A crafty vulnerability in Windows Task Scheduler allows attackers to elevate privileges with just a single command! 🔥 Think of it like an employee who finds a way to forge their access pass, allowing them to enter restricted areas of the office without ever having the right clearance. It's a sneaky way to gain power where they shouldn’t! This vulnerability could let an attacker gain administrative control of your system, allowing them to install programs, change settings, or even steal sensitive data. The potential fallout is absolutely devastating for any organization, as it opens the door for further attacks or data breaches.

Put simply

Think of it like an employee who finds a way to forge their access pass, allowing them to enter restricted areas of the office without ever having the right clearance. It's a sneaky way to gain power where they shouldn’t! CVE-2024-49039 is an elevation of privilege vulnerability in Windows Task Scheduler that can be exploited through specially crafted tasks, giving an unauthorized user admin-level access to the system.

What to do

This vulnerability could let an attacker gain administrative control of your system, allowing them to install programs, change settings, or even steal sensitive data. The potential fallout is absolutely devastating for any organization, as it opens the door for further attacks or data breaches. Update your systems immediately to the latest security patches and monitor for any suspicious task schedules. Implement strict user permissions to limit who can create or manage tasks in Windows Task Scheduler. 🛡️ You've got this! Stay vigilant and proactive, and you’ll keep your systems safe! ⚡😄

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.14179 · 96.6th percentile
Weakness
CWE-287 · Improper Authentication
Published
2024-11-12T23:15Z
KEV added
2024-11-12 · due 2024-12-03
Affected products (23)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.2082610.0.10240.20826
microsoft/windows_10_1507< 10.0.10240.2082610.0.10240.20826
microsoft/windows_10_1607< 10.0.14393.751510.0.14393.7515
microsoft/windows_10_1607< 10.0.14393.751510.0.14393.7515
microsoft/windows_10_1809< 10.0.17763.653210.0.17763.6532
microsoft/windows_10_1809< 10.0.17763.653210.0.17763.6532
microsoft/windows_10_21h2< 10.0.19044.513110.0.19044.5131
microsoft/windows_10_21h2< 10.0.19044.513110.0.19044.5131
microsoft/windows_10_21h2< 10.0.19044.513110.0.19044.5131
microsoft/windows_10_22h2< 10.0.19045.513110.0.19045.5131
microsoft/windows_10_22h2< 10.0.19045.513110.0.19045.5131
microsoft/windows_10_22h2< 10.0.19045.513110.0.19045.5131
microsoft/windows_11_22h2< 10.0.22621.446010.0.22621.4460
microsoft/windows_11_22h2< 10.0.22621.446010.0.22621.4460
microsoft/windows_11_23h2< 10.0.22631.446010.0.22631.4460
microsoft/windows_11_23h2< 10.0.22631.446010.0.22631.4460
microsoft/windows_11_24h2< 10.0.26100.231410.0.26100.2314
microsoft/windows_11_24h2< 10.0.26100.231410.0.26100.2314
microsoft/windows_server_2016< 10.0.14393.751510.0.14393.7515
microsoft/windows_server_2019< 10.0.17763.653210.0.17763.6532
microsoft/windows_server_2022< 10.0.20348.284910.0.20348.2849
microsoft/windows_server_2022_23h2< 10.0.25398.125110.0.25398.1251
microsoft/windows_server_2025< 10.0.26100.231410.0.26100.2314
References (2)
EPSS history
Timeline
  • 12 NOV 17:54Z
    Windows Task Scheduler Elevation of Privilege Vulnerability
    cvelistv5
  • 12 NOV 00:00Z
    Added to CISA KEV — remediate by Dec 3
    kev