CISA confirmed this vulnerability is used in real attacks on 10.09.2024. Remediation deadline for US federal agencies: 01.10.2024.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38226; https://nvd.nist.gov/vuln/detail/CVE-2024-38226
Microsoft Publisher Security Feature Bypass Vulnerability
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| Microsoft | Microsoft Office 2019 | 19.0.0 – < https://aka.ms/OfficeSecurityReleases | |
| Microsoft | Microsoft Office LTSC 2021 | 16.0.1 – < https://aka.ms/OfficeSecurityReleases | |
| Microsoft | Microsoft Publisher 2016 | 16.0.0 – < 16.0.5465.1001 | |
| microsoft | office | 19.0.0 – < https://aka.ms/OfficeSecurityReleases | |
| microsoft | office 2019 | — | |
| microsoft | office long term servicing channel | 16.0.1 – < https://aka.ms/OfficeSecurityReleases | |
| microsoft | publisher | 16.0.0 – < 16.0.5465.1001 |
cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x64:*cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x86:*cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:x64:*cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:x86:*cpe:2.3:a:microsoft:publisher:2016:*:*:*:*:*:x64:*cpe:2.3:a:microsoft:publisher:2016:*:*:*:*:*:x86:*Our free, open-source honeypot sensor waits on ports your server does not use and reports the scanners and attackers that connect to a shared blocklist.