CVE-2024-43475
Published: 10 September 2024
Summary
CVE-2024-43475 is a high-severity Buffer Over-read (CWE-126) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.3 (High).
Operationally, ranked in the top 7.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Microsoft Windows Admin Center contains an information disclosure vulnerability tracked as CVE-2024-43475. The flaw, which carries a CVSS v3.1 score of 7.3, is associated with CWE-126 and was published on September 10, 2024.
An attacker with low privileges can exploit the issue over a network with limited complexity and some user interaction required, resulting in high confidentiality impact and high availability impact on the affected component.
The Microsoft Security Response Center advisory linked in the reference provides official guidance on available updates and mitigation steps. The EPSS score rose from a low baseline to a peak of 0.1076 on 2025-12-11 before receding to the current value of 0.0873.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40742
Vulnerability details
Microsoft Windows Admin Center Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.