Microsoft patches two exploited zero-days

Microsoft's October 2024 patch Tuesday addresses CVE-2024-43572 and CVE-2024-43573, both confirmed exploited in the wild, enabling attackers to control systems.

Japan's IPA has issued an urgent advisory following Microsoft's October 2024 patch Tuesday release. The update addresses multiple vulnerabilities in Microsoft products, including two zero-day flaws that Microsoft confirms are being actively exploited in the wild. The exploited vulnerabilities are tracked as CVE-2024-43572 and CVE-2024-43573. Successful exploitation of these flaws could allow attackers to cause application crashes, achieve remote code execution, or gain full control of compromised systems.

IPA emphasizes the urgency of applying these security updates immediately due to confirmed exploitation and the risk of expanded targeting. Organizations are advised to deploy patches through their standard update management processes. For individual users, Windows Update typically handles security patches automatically, though system restarts may be required to complete installation.

Source reporting: https://www.ipa.go.jp/security/security-alert/2024/1009-ms.html