CVE-2024-49039
Published: November 12, 2024
Official Description
Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.
CISA KEV Advisory
Microsoft Windows Task Scheduler Privilege Escalation Vulnerability
Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Risk Analysis
This privilege escalation vulnerability in Microsoft Windows Task Scheduler allows a local application to escalate privileges outside its AppContainer and access privileged RPC functions. This poses a significant risk to system security, as it can lead to unauthorized access and control. The high EPSS score of 0.66378 and its inclusion in CISA's KEV confirm active exploitation.
Active exploitation of this vulnerability has been observed in the wild. This is a local privilege escalation flaw, meaning an attacker needs initial access to the system.
Apply all available security updates for Microsoft Windows to patch the Task Scheduler vulnerability. Implement the principle of least privilege for all applications and user accounts.
Technical Analysis
CVE-2024-49039 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2024-49039 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Affected Vendors & Products
Exploit & PoC Resources
All References (2)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2024-49039 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1