PatchaPalooza

CVE-2024-49039: Windows Task Scheduler Elevation of Privilege Vulnerability

CVE-2024-49039 is an elevation of privilege vulnerability in Windows Task Scheduler, rated Important by Microsoft, with a CVSS 3.1 base score of 8.8 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft reports that it has been exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on 12 November 2024, with a remediation deadline of 3 December 2024 for US federal agencies. It is known to be used in ransomware campaigns. The EPSS model estimates a 14.18% probability of exploitation activity in the next 30 days, higher than 97% of all scored vulnerabilities. Microsoft released the fix on 12 November 2024 in the November 2024 Patch Tuesday, delivered through 10 security updates (KB5046617, KB5046696, KB5046615, KB5046616 and more). It affects 27 products in 1 product family (Windows).

Key facts

CVE ID
CVE-2024-49039
Severity
High CVSS 8.8
Microsoft severity
Important
Impact
Elevation of Privilege
Exploited in the wild
Yes
Publicly disclosed
No
Exploitation likelihood
Detected
Weakness
CWE-287
EPSS
14.18% (percentile 97%)
CISA KEV
Listed , due
Released
Last updated
Patch Tuesday
November 2024 Patch Tuesday
Product families
Windows

CVSS score and vector

Microsoft scores CVE-2024-49039 at 8.8 (temporal 8.2) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C

MetricValue
Attack vectorLocal
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit code maturityFunctional
Remediation levelOfficial fix
Report confidenceConfirmed

Frequently asked questions (Microsoft)

How could an attacker exploit this vulnerability?

To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application on the target system exploit the vulnerability to elevate their privileges to a Medium Integrity Level.

According to the CVSS metric, successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?

In this case, a successful attack could be performed from a low privilege AppContainer. The attacker could elevate their privileges and execute code or access resources at a higher integrity level than that of the AppContainer execution environment.

What privileges could be gained by an attacker who successfully exploited the vulnerability?

An attacker who successfully exploited this vulnerability could execute RPC functions that are restricted to privileged accounts only.

Affected products (27)

Windows

ProductSecurity updateTypeFixed buildRestart
Windows Server 2025KB5046617
KB5046696		Security Update
SecurityHotpatchUpdate		10.0.26100.2314
10.0.26100.2240		Yes
Yes
Windows Server 2025 (Server Core installation)KB5046617
KB5046696		Security Update
SecurityHotpatchUpdate		10.0.26100.2314
10.0.26100.2240		Yes
Yes
Windows 10 Version 1809 for 32-bit SystemsKB5046615Security Update10.0.17763.6532Yes
Windows 10 Version 1809 for x64-based SystemsKB5046615Security Update10.0.17763.6532Yes
Windows Server 2019KB5046615Security Update10.0.17763.6532Yes
Windows Server 2019 (Server Core installation)KB5046615Security Update10.0.17763.6532Yes
Windows Server 2022KB5046616
KB5046698		Security Update
SecurityHotpatchUpdate		10.0.20348.2849
10.0.20348.2819		Yes
Yes
Windows Server 2022 (Server Core installation)KB5046616
KB5046698		Security Update
SecurityHotpatchUpdate		10.0.20348.2849
10.0.20348.2819		Yes
Yes
Windows 10 Version 21H2 for 32-bit SystemsKB5046613Security Update10.0.19044.5131Yes
Windows 10 Version 21H2 for ARM64-based SystemsKB5046613Security Update10.0.19044.5131Yes
Windows 10 Version 21H2 for x64-based SystemsKB5046613Security Update10.0.19044.5131Yes
Windows 11 Version 22H2 for ARM64-based SystemsKB5046633Security Update10.0.22621.4460Yes
Windows 11 Version 22H2 for x64-based SystemsKB5046633Security Update10.0.22621.4460Yes
Windows 10 Version 22H2 for x64-based Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for 32-bit Systems
Windows 11 Version 23H2 for ARM64-based Systems
Windows 11 Version 23H2 for x64-based Systems
Windows Server 2022, 23H2 Edition (Server Core installation)KB5046618Security Update10.0.25398.1251Yes
Windows 11 Version 24H2 for ARM64-based SystemsKB5046696SecurityHotpatchUpdate10.0.26100.2240Yes
Windows 11 Version 24H2 for x64-based SystemsKB5046696SecurityHotpatchUpdate10.0.26100.2240Yes
Windows 10 for 32-bit SystemsKB5046665Security Update10.0.10240.20826Yes
Windows 10 for x64-based SystemsKB5046665Security Update10.0.10240.20826Yes
Windows 10 Version 1607 for 32-bit SystemsKB5046612Security Update10.0.14393.7515Yes
Windows 10 Version 1607 for x64-based SystemsKB5046612Security Update10.0.14393.7515Yes
Windows Server 2016KB5046612Security Update10.0.14393.7515Yes
Windows Server 2016 (Server Core installation)KB5046612Security Update10.0.14393.7515Yes

Security updates (10)

Exploitation and detection

CISA Known Exploited Vulnerabilities

Date added
Federal due date
Ransomware use
Known
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

VulnCheck KEV

Date added
Ransomware use
Known
Independent sources
16

Public exploits (2)

Detection and weaponization

Weaponization maturity: Exploit.

Proof-of-concept repositories (2)

NIST NVD data

NVD status
Analyzed
NVD CVSS
8.8 (HIGH)
NVD weakness
CWE-287
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
windows 10 1507 (x64)before 10.0.10240.20826
windows 10 1507 (x86)before 10.0.10240.20826
windows 10 1607 (x64)before 10.0.14393.7515
windows 10 1607 (x86)before 10.0.14393.7515
windows 10 1809 (x64)before 10.0.17763.6532
windows 10 1809 (x86)before 10.0.17763.6532
windows 10 21h2 (arm64)before 10.0.19044.5131
windows 10 21h2 (x64)before 10.0.19044.5131
windows 10 21h2 (x86)before 10.0.19044.5131
windows 10 22h2 (arm64)before 10.0.19045.5131
windows 10 22h2 (x64)before 10.0.19045.5131
windows 10 22h2 (x86)before 10.0.19045.5131
windows 11 22h2 (arm64)before 10.0.22621.4460
windows 11 22h2 (x64)before 10.0.22621.4460
windows 11 23h2 (arm64)before 10.0.22631.4460
windows 11 23h2 (x64)before 10.0.22631.4460
windows 11 24h2 (arm64)before 10.0.26100.2314
windows 11 24h2 (x64)before 10.0.26100.2314
windows server 2016before 10.0.14393.7515
windows server 2019before 10.0.17763.6532
windows server 2022before 10.0.20348.2849
windows server 2022 23h2before 10.0.25398.1251
windows server 2025before 10.0.26100.2314

References

Acknowledgments

  • Anonymous
  • Vlad Stolyarov and Bahare Sabouri of Google's Threat Analysis Group
  • Mozilla Security Team

Revision history

VersionDateDescription
1.0Information published.
1.1Added acknowledgements. This is an informational change only.

Sources