CVE-2024-43572: Microsoft Management Console remote code execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw allows code execution with high impact across a wide Windows install base and is listed in CISA KEV as exploited, though it requires local access and user interaction rather than being remotely exploitable without action.

What it is

CVE-2024-43572 is a remote code execution vulnerability in the Microsoft Management Console (MMC) affecting a broad range of Windows 10, Windows 11 and Windows Server releases. The record gives only a one-line description and no root-cause detail, but the flaw is serious enough that CISA added it to the Known Exploited Vulnerabilities catalog on the day of publication.

Impact

An attacker who gets the crafted input opened can execute code in the context of the victim, giving full compromise of confidentiality, integrity and availability on that host. Because MMC is a common administrative tool, successful exploitation on an admin workstation or server can expose privileged management sessions.

Attack surface

The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), so the attacker must get a victim to open a malicious file or console document on the target machine. It is not remotely reachable without that user action, and no authentication is needed beyond the victim's own session.

Exploitation

CISA added this CVE to KEV on 2024-10-08 with a remediation due date of 2024-10-29, indicating exploitation in the wild. EPSS is 0.667 (99.25th percentile), and the only references are the Microsoft patch advisory and the KEV entry; no public exploit or ransomware use is documented in this record.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2024-43572 on all affected Windows 10, Windows 11 and Windows Server systems, prioritizing internet-facing and administrative hosts.
• If patching cannot be completed by the KEV due date, follow CISA guidance to apply vendor mitigations or discontinue use of the affected product.
• Restrict users from opening untrusted .msc console files or other MMC documents received by email, download or shared drive, and block these file types at email and web gateways where feasible.
• Reduce the number of users with local administrative rights so that code execution through MMC is less likely to yield privileged access.
• Track KEV remediation status to confirm all affected endpoints are patched before the 2024-10-29 deadline.

Detection

• Monitor process creation for mmc.exe spawning child processes such as cmd.exe, powershell.exe, wscript.exe or rundll32.exe, which is unusual for normal console use.
• Alert on mmc.exe loading or opening .msc files from user-writable or temporary paths, especially Downloads, Temp and email attachment directories.
• Review Windows event logs and EDR telemetry for suspicious MMC activity on hosts that have not yet received the October 2024 Microsoft updates.
• Hunt for file writes or execution originating from MMC processes in user profile directories, which may indicate a malicious console document was opened.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.