---
id: "CVE-2024-43572"
kind: "vulnerability"
aliases: ["CVE-2024-43572"]
title: "Microsoft Management Console Remote Code Execution Vulnerability"
severity: "high"
cvss: 7.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Windows", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft windows 10 1507", "fixed": ["10.0.10240.20796"], "affected": "< 10.0.10240.20796", "ecosystem": "vendor"}, {"name": "microsoft windows 10 1607", "fixed": ["10.0.14393.7428"], "affected": "< 10.0.14393.7428", "ecosystem": "vendor"}, {"name": "microsoft windows 10 1809", "fixed": ["10.0.17763.6414"], "affected": "< 10.0.17763.6414", "ecosystem": "vendor"}, {"name": "microsoft windows 10 21h2", "fixed": ["10.0.19044.5011"], "affected": "< 10.0.19044.5011", "ecosystem": "vendor"}, {"name": "microsoft windows 10 22h2", "fixed": ["10.0.19045.5011"], "affected": "< 10.0.19045.5011", "ecosystem": "vendor"}, {"name": "microsoft windows 11 21h2", "fixed": ["10.0.22000.3260"], "affected": "< 10.0.22000.3260", "ecosystem": "vendor"}, {"name": "microsoft windows 11 22h2", "fixed": ["10.0.22621.4317"], "affected": "< 10.0.22621.4317", "ecosystem": "vendor"}, {"name": "microsoft windows 11 23h2", "fixed": ["10.0.22631.4317"], "affected": "< 10.0.22631.4317", "ecosystem": "vendor"}, {"name": "microsoft windows 11 24h2", "fixed": ["10.0.26100.2033"], "affected": "< 10.0.26100.2033", "ecosystem": "vendor"}, {"name": "microsoft windows server 2008", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft windows server 2008", "fixed": [], "affected": "= r2", "ecosystem": "vendor"}, {"name": "microsoft windows server 2012", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft windows server 2012", "fixed": [], "affected": "= r2", "ecosystem": "vendor"}, {"name": "microsoft windows server 2016", "fixed": ["10.0.14393.7428"], "affected": "< 10.0.14393.7428", "ecosystem": "vendor"}, {"name": "microsoft windows server 2019", "fixed": ["10.0.17763.6414"], "affected": "< 10.0.17763.6414", "ecosystem": "vendor"}, {"name": "microsoft windows server 2022", "fixed": ["10.0.20348.2762"], "affected": "< 10.0.20348.2762", "ecosystem": "vendor"}, {"name": "microsoft windows server 2022 23h2", "fixed": ["10.0.25398.1189"], "affected": "< 10.0.25398.1189", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "microsoft-management-console", "windows"]
not_affected_if: ["unknown"]
published_at: "2024-10-08T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43572", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43572", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# Microsoft Management Console Remote Code Execution Vulnerability

Microsoft Windows Management Console (MMC) has a remote code execution flaw, and CISA lists it as actively exploited in the wild. The description does not say how the attack is delivered, so an attacker could potentially run code on a Windows machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Windows affected ? fixed ?
- vendor:microsoft windows 10 1507 affected < 10.0.10240.20796 fixed 10.0.10240.20796
- vendor:microsoft windows 10 1607 affected < 10.0.14393.7428 fixed 10.0.14393.7428
- vendor:microsoft windows 10 1809 affected < 10.0.17763.6414 fixed 10.0.17763.6414
- vendor:microsoft windows 10 21h2 affected < 10.0.19044.5011 fixed 10.0.19044.5011
- vendor:microsoft windows 10 22h2 affected < 10.0.19045.5011 fixed 10.0.19045.5011
- vendor:microsoft windows 11 21h2 affected < 10.0.22000.3260 fixed 10.0.22000.3260
- vendor:microsoft windows 11 22h2 affected < 10.0.22621.4317 fixed 10.0.22621.4317
- vendor:microsoft windows 11 23h2 affected < 10.0.22631.4317 fixed 10.0.22631.4317
- vendor:microsoft windows 11 24h2 affected < 10.0.26100.2033 fixed 10.0.26100.2033
- vendor:microsoft windows server 2008 affected ? fixed ?
- vendor:microsoft windows server 2008 affected = r2 fixed ?
- vendor:microsoft windows server 2012 affected ? fixed ?
- vendor:microsoft windows server 2012 affected = r2 fixed ?
- vendor:microsoft windows server 2016 affected < 10.0.14393.7428 fixed 10.0.14393.7428
- vendor:microsoft windows server 2019 affected < 10.0.17763.6414 fixed 10.0.17763.6414
- vendor:microsoft windows server 2022 affected < 10.0.20348.2762 fixed 10.0.20348.2762
- vendor:microsoft windows server 2022 23h2 affected < 10.0.25398.1189 fixed 10.0.25398.1189

## Fix

Apply the Microsoft security update for CVE-2024-43572 (September 2024 Patch Tuesday) or follow vendor mitigations; the sources do not give the KB number.
If no mitigation is available, CISA says to discontinue use of the affected product.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43572
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-43572

## From the sources

Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_