CVE-2024-49039: high-severity vulnerability in Microsoft Windows 10 Version 1507
Windows Task Scheduler Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A flaw in Windows Task Scheduler allows an attacker with limited user account access to gain higher-level system privileges, potentially taking full control of the computer.
An authentication bypass vulnerability in Windows Task Scheduler (CWE-287) permits a low-privileged local attacker to execute arbitrary code with elevated system privileges. The vulnerability requires local access but does not need administrative credentials, enabling privilege escalation through task manipulation.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.