{"id":"CVE-2024-43572","kind":"vulnerability","aliases":["CVE-2024-43572"],"related":[],"title":"Microsoft Management Console Remote Code Execution Vulnerability","description":"Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Microsoft Windows Management Console (MMC) has a remote code execution flaw, and CISA lists it as actively exploited in the wild. The description does not say how the attack is delivered, so an attacker could potentially run code on a Windows machine.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2024-10-08T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1507","fixed":["10.0.10240.20796"],"affected":"< 10.0.10240.20796","ecosystem":"vendor"},{"name":"microsoft windows 10 1607","fixed":["10.0.14393.7428"],"affected":"< 10.0.14393.7428","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":["10.0.17763.6414"],"affected":"< 10.0.17763.6414","ecosystem":"vendor"},{"name":"microsoft windows 10 21h2","fixed":["10.0.19044.5011"],"affected":"< 10.0.19044.5011","ecosystem":"vendor"},{"name":"microsoft windows 10 22h2","fixed":["10.0.19045.5011"],"affected":"< 10.0.19045.5011","ecosystem":"vendor"},{"name":"microsoft windows 11 21h2","fixed":["10.0.22000.3260"],"affected":"< 10.0.22000.3260","ecosystem":"vendor"},{"name":"microsoft windows 11 22h2","fixed":["10.0.22621.4317"],"affected":"< 10.0.22621.4317","ecosystem":"vendor"},{"name":"microsoft windows 11 23h2","fixed":["10.0.22631.4317"],"affected":"< 10.0.22631.4317","ecosystem":"vendor"},{"name":"microsoft windows 11 24h2","fixed":["10.0.26100.2033"],"affected":"< 10.0.26100.2033","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2016","fixed":["10.0.14393.7428"],"affected":"< 10.0.14393.7428","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":["10.0.17763.6414"],"affected":"< 10.0.17763.6414","ecosystem":"vendor"},{"name":"microsoft windows server 2022","fixed":["10.0.20348.2762"],"affected":"< 10.0.20348.2762","ecosystem":"vendor"},{"name":"microsoft windows server 2022 23h2","fixed":["10.0.25398.1189"],"affected":"< 10.0.25398.1189","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","microsoft-management-console","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2024-43572 (September 2024 Patch Tuesday) or follow vendor mitigations; the sources do not give the KB number.\nIf no mitigation is available, CISA says to discontinue use of the affected product.","status":"open","published_at":"2024-10-08T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:31+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:56:31Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2024-43572 (September 2024 Patch Tuesday) or follow vendor mitigations; the sources do not give the KB number.\nIf no mitigation is available, CISA says to discontinue use of the affected product.","reach":"unknown","impact":"high","summary":"Microsoft Windows Management Console (MMC) has a remote code execution flaw, and CISA lists it as actively exploited in the wild. The description does not say how the attack is delivered, so an attacker could potentially run code on a Windows machine.","category":"infrastructure","who_cares":["windows","microsoft-management-console"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the Windows machine remotely","analyst_note":"Find the Microsoft advisory for CVE-2024-43572 to confirm the KB numbers, affected Windows builds, attack vector, and any required user interaction.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000482,"input_tokens":2796,"output_tokens":405,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':9A,12A '-43572':10A,13A '10':18A,22A,26A,30A,34A '11':38A,42A,46A,50A '1507':19A '1607':23A '1809':27A '2008':55A,59A '2012':63A,67A '2016':71A '2019':75A '2022':79A,83A '21h2':31A,39A '22h2':35A,43A '23h2':47A,84A '24h2':51A 'action':149C 'activ':108B 'allow':142C 'appli':150C 'attack':120B,125B 'cisa':104B,147C 'code':5A,100B,129B,145C 'consol':3A,90B,95B,137C 'contain':138C 'could':126B 'cve':8A,11A 'deliv':122B 'descript':114B 'discontinu':156C 'execut':6A,101B,146C 'exploit':85B,109B 'flaw':102B 'infrastructur':86B 'instruct':154C 'list':105B 'machin':133B 'manag':2A,89B,94B,136C 'microsoft':1A,14A,16A,20A,24A,28A,32A,36A,40A,44A,48A,52A,56A,60A,64A,68A,72A,76A,80A,88B,92B,134C 'microsoft-management-consol':87B 'mitig':151C,162C 'mmc':96B 'per':152C 'potenti':127B 'product':160C 'remot':4A,99B,144C 'requir':148C 'run':128B 'say':117B 'server':54A,58A,62A,66A,70A,74A,78A,82A 'unavail':164C 'unspecifi':139C 'use':157C 'vendor':153C 'vulner':7A,140C 'wild':112B 'window':91B,93B,132B,135C 'windows':15A,17A,21A,25A,29A,33A,37A,41A,45A,49A,53A,57A,61A,65A,69A,73A,77A,81A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-10-08T00:00:00+00:00","kev":{"dateAdded":"2024-10-08","dueDate":"2024-10-29","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-43572","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43572","severity":null,"published_at":"2024-10-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T17:39:56+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-43572","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43572","severity":null,"published_at":"2024-10-08T18:15:24+00:00","modified_at":"2026-06-17T07:51:19+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}