The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning for all organizations and users to address a critical Windows vulnerability, CVE-2024-35250, before January 6, 2025. On December 17, Forbes highlighted Microsoft’s proactive response to a Windows Kernel-Mode Driver flaw that could allow attackers to escalate privileges from local user to system admin, emphasizing the importance of timely updates. Given its low attack complexity, malicious actors have already begun exploiting it, prompting CISA to add it to its Known Exploited Vulnerabilities (KEV) catalog. While federal agencies must act under Binding Operational Directive 22-01, all organizations are strongly urged to patch systems immediately.

Additional References

• Microsoft MSRC (Security Response Center): CVE-2024-35250 – Security Update Guide – Microsoft – Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
• NIST’s NVD (National Vulnerability Database): NVD – cve-2024-35250

Queue Associates, a leading global Microsoft Solutions Partner, recognizes the importance of staying secure and up to date. Our team is ready to assist organizations with security updates, patch management, and comprehensive Microsoft support. Whether behind on critical updates or needing proactive cybersecurity guidance, Queue ensures your systems remain protected and compliant.