CVE-2024-49040
Published: 12 November 2024
Summary
CVE-2024-49040 is a high-severity User Interface (UI) Misrepresentation of Critical Information (CWE-451) vulnerability in Microsoft Exchange Server. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 9.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Microsoft Exchange Server is affected by a spoofing vulnerability tracked as CVE-2024-49040. The flaw received a CVSS v3.1 base score of 7.5 reflecting a network attack vector that requires no privileges or user interaction and produces a high impact on integrity, and it is catalogued under CWE-451.
An unauthenticated remote attacker can send specially crafted requests to spoof identity or content, thereby altering information processed by the server without any interaction from legitimate users.
The associated EPSS probability rose from a low baseline to a peak of 0.1561 on 2025-12-18 before receding to its current value of 0.0539, indicating that exploitation interest emerged after public disclosure. Official mitigation details are provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49040.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43911
Vulnerability details
Microsoft Exchange Server Spoofing Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.