InfoSecBulletin Cybersecurity for mankind
CISA warned U.S. government agencies on Thursday to protect their systems from a critical Microsoft Configuration Manager vulnerability that was fixed in October 2024 and is currently being exploited. Microsoft Configuration Manager is a tool for IT management of many Windows servers and workstations.
CVE-2024-43468 is an SQL injection vulnerability discovered by Synacktiv that lets remote attackers execute arbitrary commands on the server and Microsoft Configuration Manager database without any privileges.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
“An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database,” Microsoft explained when it patched the flaw in October 2024.
At the time, Microsoft tagged it as “Exploitation Less Likely,” saying that “an attacker would likely have difficulty creating the code, requiring expertise and/or sophisticated timing, and/or varied results when targeting the affected product.”
CISA has now identified CVE-2024-43468 as being actively exploited and has instructed Federal Civilian Executive Branch (FCEB) agencies to update their systems by March 5th, as required by the Binding Operational Directive (BOD) 22-01.
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” the U.S. cybersecurity agency warned.
“Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.”
BOD 22-01 is aimed at federal agencies, but CISA urged all network defenders, including private sector ones, to quickly secure their devices against CVE-2024-43468 attacks.
| Action | Details |
|---|---|
| Immediate Actions | Scan with Defender or SSMS for suspicious queries. |
| Patch Fast | Install updates; test before production rollout. |
| Mitigate | Block untrusted IPs, enable IIS protection, use least privilege. |
| Cloud Twist | Enable MFA, logging, and zero-trust for Azure setups. |
Immediate Actions: Scan environments with tools like Microsoft Defender or SQL Server Management Studio for anomalous queries.
Patch Fast:Â Download updates from Microsoft Update Catalog. Test in staging first to avoid disrupting console access.
