CVE-2024-43572: Microsoft Windows Management Console Remote Code Execution Vulnerability
What It Is — An unspecified flaw in the Microsoft Windows Management Console (MMC) permits an unauthenticated attacker to execute arbitrary code on the host system. The vulnerability is tracked as CVE‑2024‑43572 and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
Exploitability — No public exploit has been released, but the remote‑code‑execution nature makes the flaw highly attractive to threat actors. Microsoft has assigned a CVSS v3.1 base score of 9.8 (Critical).
Affected Products — All supported Windows client and server editions that include MMC (e.g., Windows 10, Windows 11, Windows Server 2016‑2022).
Why It Matters for Trust & Control Assurance
- Patch Management Discipline – Demonstrating that you have a documented, repeatable process for applying critical OS patches is a core control evidence point for auditors.
- Continuous Monitoring – Real‑time inventory of patch status across endpoints provides a defensible audit trail and reduces the window of exposure.
- Supply‑Chain Assurance – Many third‑party tools rely on MMC; a compromised host can become a launchpad for broader supply‑chain attacks, underscoring the need for verifiable remediation evidence.
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2024‑43572 immediately via Windows Update, WSUS, or your enterprise patch‑management solution.
- Verify remediation by scanning endpoints for the patched MMC version and documenting the results in your configuration‑management database (CMDB).
- Update your vulnerability‑management policy to include rapid response timelines for any future KEV listings.
- Capture patch‑deployment logs as part of your continuous‑control‑evidence repository for audit readiness.
Source: CISA KEV – CVE‑2024‑43572