In CISA KEV9.8 CriticalCWE-89
CVE-2024-43468
Microsoft Configuration Manager SQL Injection Vulnerability
MicrosoftConfiguration Manager
Status
- Exploited in the wild
- In CISA KEV since 12 Feb
- Vendor fix available
Federal deadlineThu 5 Mar, 23:59 UTC
Passed 233 days ago
CISA KEV · added 12 Feb
Exploit probabilityEPSSchecked 25 Oct
81%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
Microsoft Configuration Manager Remote Code Execution Vulnerability
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 13 Feb · 09:35 UTC | Security Affairs | U.S. CISA adds SolarWinds Web Help Desk, Notepad++, Microsoft Configuration Manager, and Apple devices flaws to its Known Exploited Vulnerabilities catalog |
| Fri 13 Feb · 10:05 UTC | The Hacker News | Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability |
| Fri 13 Feb · 11:10 UTC | SecurityWeek | CISA Warns of Exploited SolarWinds, Notepad++, Microsoft Vulnerabilities |
- CISA Warns of Exploited SolarWinds, Notepad++, Microsoft VulnerabilitiesSecurityWeek · mentions it in passing
- Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 VulnerabilityThe Hacker News · mentions it in passing
- U.S. CISA adds SolarWinds Web Help Desk, Notepad++, Microsoft Configuration Manager, and Apple devices flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · first in our coverage