Article Details
Scrape Timestamp (UTC): 2026-02-13 18:50:30.716
Source: https://www.theregister.com/2026/02/13/critical_microsoft_bug_from_2024/
Original Article Text
Click to Toggle View
Attackers finally get around to exploiting critical Microsoft bug from 2024. As if admins haven't had enough to do this week. Ignore patches at your own risk. According to Uncle Sam, a SQL injection flaw in Microsoft Configuration Manager patched in October 2024 is now being actively exploited, exposing unpatched businesses and government agencies to attack. The US Cybersecurity and Infrastructure Security Agency added CVE-2024-43468 to its Known Exploited Vulnerabilities catalog on Thursday, setting a March 5 deadline for federal agencies to deploy the patch. The 9.8-rated SQL injection vulnerability exists in Microsoft Configuration Manager, which IT admins use to manage organizations' Windows-based servers and laptops. And it allows unauthenticated, remote attackers to execute commands on the server and/or underlying database. It's a very serious flaw that needs to be fixed ASAP - or 16 months ago. Mehdi Elyassa, a red teamer at French cybersecurity firm Synacktiv, found and reported the bug to Microsoft. The Register reached out to Microsoft for comment, but did not immediately receive responses to our questions, so we don't know who is battering this bug or how many customers are affected. We will update this story when we hear back. CISA says it's "unknown" if this CVE has been abused in ransomware attacks. When it originally disclosed the bug in October 2024, Microsoft deemed it "exploitation less likely," and the Windows vendor's security update still lists that vulnerability as not being under attack. Since that time, however, at least two proof-of-concept exploits have been published, so you really should drop everything else and patch this bug before taking off for the long Presidents' Day weekend. We're sincerely hoping that all Microsoft admins, or at least those in the US, enjoy the Monday holiday after what has been a very busy second week of February. On Tuesday, Redmond gifted them with 59 new CVEs, six of which had already been exploited before Microsoft issued a patch. Per usual, Microsoft did not provide additional details about who attacked these six flaws and how widespread exploitation may be. Three of the six, however, are also listed as publicly disclosed - meaning there may already be proof-of-concept exploits available. So it's likely we'll hear about these CVEs under attack soon, and not a year and a half from now.
Daily Brief Summary
A critical SQL injection flaw in Microsoft Configuration Manager, CVE-2024-43468, is now being actively exploited, posing risks to unpatched businesses and government agencies.
The vulnerability, rated 9.8, allows unauthenticated remote attackers to execute commands on servers and databases, necessitating immediate patching.
The US Cybersecurity and Infrastructure Security Agency has added this flaw to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch by March 5.
Discovered by Synacktiv's Mehdi Elyassa, the flaw was initially deemed "exploitation less likely," but recent proof-of-concept exploits indicate active threats.
Microsoft has not yet commented on the extent of exploitation or the number of affected customers, leaving organizations uncertain about the full impact.
The urgency to address this vulnerability is heightened by recent disclosures of other exploited CVEs, with Microsoft releasing 59 new CVEs this month alone.
Organizations are advised to prioritize patching this vulnerability to mitigate potential attacks and ensure system security during a period of increased cyber activity.