CISA Warns of Three Vulnerabilities Actively Exploited in the Wild

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert about three critical vulnerabilities that are actively being exploited in the wild.

These vulnerabilities impact widely used software from Microsoft, Mozilla, and SolarWinds, posing significant security threats to organizations and individuals.

CVE-2024-30088: Microsoft Windows Kernel TOCTOU Race Condition Vulnerability

The first vulnerability, CVE-2024-30088, is a time-of-check to time-of-use (TOCTOU) race condition within the Microsoft Windows Kernel.

This flaw could enable attackers to escalate their privileges on a compromised system. Although it is currently unclear whether this vulnerability is being exploited in ransomware campaigns, the potential for exploitation remains significant.

Users are advised to apply mitigations according to Microsoft’s instructions or discontinue using the affected product if no mitigations are available. The deadline for addressing this vulnerability is November 5, 2024.

CVE-2024-9680: Mozilla Firefox Use-After-Free Vulnerability

The second vulnerability, CVE-2024-9680, impacts both Mozilla Firefox and Firefox ESR. It involves a use-after-free vulnerability in animation timelines, which could allow attackers to execute arbitrary code within the content process.

Similar to the Microsoft vulnerability, it is uncertain whether this flaw is being exploited in ransomware attacks.

Mozilla users are advised to implement the recommended mitigations from the vendor or stop using the affected versions of Firefox until solutions are provided. The deadline for remediation is set for November 5, 2024.

CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability

The third vulnerability, designated as CVE-2024-28987, affects SolarWinds Web Help Desk. This issue involves hardcoded credentials that could allow remote, unauthenticated users to access internal functionalities and modify data.

While there is no current evidence of its exploitation in ransomware campaigns, the potential for abuse remains a significant concern.

Organizations utilizing SolarWinds Web Help Desk should adhere to vendor instructions for mitigation or cease using the software if no fixes are provided by November 5, 2024.

CISA’s alert highlights the critical need for timely patching and mitigation to safeguard systems from these vulnerabilities. Organizations are strongly encouraged to prioritize these updates to protect their networks from potential attacks.

As cyber threats continue to evolve, maintaining vigilance and implementing proactive security measures are essential for defending against exploitation.