Secuno
ENNL
Book demo

CVE-2024-43491

Microsoft Windows 10 1507 vulnerability

9.8 CRITICALEPSS 12.9%
  1. Published10 Sept 2024

Description

Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, version 1507 (initial version released July 2015). This means that an attacker could exploit these previously mitigated vulnerabilities on Windows 10, version 1507 (Windows 10 Enterprise 2015 LTSB and Windows 10 IoT Enterprise 2015 LTSB) systems that have installed the Windows security update released on March 12, 2024—KB5035858 (OS Build 10240.20526) or other updates released until August 2024. All later versions of Windows 10 are not impacted by this vulnerability. This servicing stack vulnerability is addressed by installing the September 2024 Servicing stack update (SSU KB5043936) AND the September 2024 Windows security update (KB5043083), in that order. Note: Windows 10, version 1507 reached the end of support (EOS) on May 9, 2017 for devices running the Pro, Home, Enterprise, Education, and Enterprise IoT editions. Only Windows 10 Enterprise 2015 LTSB and Windows 10 IoT Enterprise 2015 LTSB editions are still under support.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Microsoft Windows 10 1507< 10.0.10240.20766 · ≤ 10.0.10240.20766

Remediation

Fixed in
Microsoft Windows 10 1507≥ 10.0.10240.20766

Frequently asked

Is CVE-2024-43491 being actively exploited?

CVE-2024-43491 is not in the CISA KEV catalog. Its EPSS exploit probability is 12.9%.

How severe is CVE-2024-43491?

CVE-2024-43491 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 12.9% probability of exploitation.

Which products are affected by CVE-2024-43491?

Affected products include Microsoft Windows 10 1507.

How do I fix CVE-2024-43491?

Upgrade affected software to a fixed version, for example Microsoft Windows 10 1507 10.0.10240.20766 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-43491 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.