CVE-2024-49039: Windows Task Scheduler elevation of privilege via improper authentication

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a high-CVSS local privilege escalation confirmed in CISA KEV and linked to ransomware use, though it requires existing local access rather than being remotely exploitable.

What it is

CVE-2024-49039 is an elevation of privilege flaw in the Windows Task Scheduler, classified as improper authentication (CWE-287). A local attacker with low privileges can exploit it to gain higher privileges on the host, and CISA has confirmed it is being exploited in the wild, including in ransomware campaigns.

Impact

An attacker gains elevated privileges on the affected Windows system, enabling further compromise such as credential access, persistence, or lateral movement. Because the scope is changed (S:C) and confidentiality, integrity, and availability impacts are all high, full system compromise is possible.

Attack surface

The attack is local (AV:L), requiring the attacker to already have low privileges on the machine (PR:L) with no user interaction (UI:N). It is reached by running code on the target host, not remotely over the network.

Exploitation

CVE-2024-49039 is listed in CISA's Known Exploited Vulnerabilities catalog with a due date of 2024-12-03 and is flagged as used in known ransomware campaigns. EPSS gives a 30-day exploitation probability of roughly 14.2 percent (96th percentile), and the only references are the vendor patch and the CISA KEV entry.

What to do

• Apply the Microsoft security update for CVE-2024-49039 as listed in the MSRC advisory.
• Prioritize patching for internet-facing and high-value systems, and for any host where low-privileged local access is broadly available.
• Follow CISA KEV required action: apply vendor mitigations or discontinue use of the affected product if mitigations are unavailable.
• Restrict and monitor local interactive and service account privileges to limit the value of a local privilege escalation.
• Verify patch coverage across all listed Windows 10, Windows 11, and Windows Server versions, including older builds such as 1507 and 1607.

Detection

• Monitor for unexpected creation or modification of scheduled tasks, especially those running with SYSTEM or high-privilege accounts.
• Alert on processes spawning from Task Scheduler (taskeng.exe, svchost.exe hosting Schedule) that then execute unusual child processes or load suspicious modules.
• Correlate local privilege escalation indicators with post-exploitation behavior such as credential dumping, new admin accounts, or ransomware deployment.
• Audit Windows event logs for Task Scheduler operational events and security events showing privilege changes or new service/task registrations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.