Flaws added in October 2024
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in October 2024. For the newest, see Exploited flaws.
In October 2024, CISA added 17 flaws to its list of vulnerabilities being used in attacks, 5 of them in things people have at home; 4 have been used by ransomware gangs. Most came from Microsoft (4), Ivanti (3) and Fortinet (2).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in October 2024, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-37383At work |
Roundcube Webmail. Attackers can run code in the browser of someone using Roundcube Webmail and act as them. | At work |
CVE-2024-20481At work |
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). Attackers can crash Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) or stop it working from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-47575At work |
Fortinet FortiManager. Attackers can run their own code on Fortinet FortiManager from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-38094† Used in ransomwareAt work |
Microsoft SharePoint. Attackers can run their own code on Microsoft SharePoint. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-9537At work |
ScienceLogic SL1. Attackers are using a flaw in ScienceLogic SL1 that its maker hasn't described in detail. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-40711† Used in ransomwareAt work |
Veeam Backup & Replication. Attackers can run their own code on Veeam Backup & Replication from anywhere, without logging in. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-9680† Used in ransomwareAt home |
Mozilla Firefox. Attackers can run their own code on Mozilla Firefox. | At home |
CVE-2024-30088† Used in ransomwareAt home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2024-28987At work |
SolarWinds Web Help Desk. Attackers can get into SolarWinds Web Help Desk without a valid password. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-9380At work |
Ivanti Cloud Services Appliance (CSA). Someone who already has a way in can use Ivanti Cloud Services Appliance (CSA) to run their own code. | At work |
CVE-2024-9379At work |
Ivanti Cloud Services Appliance (CSA). Attackers can read or change the database behind Ivanti Cloud Services Appliance (CSA). | At work |
CVE-2024-23113At work |
Fortinet products. Attackers can run their own code on Fortinet products from anywhere, without logging in. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-43573At home |
Microsoft Windows. Attackers can make something fake look genuine in Microsoft Windows. | At home |
CVE-2024-43572At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
CVE-2024-43047At home |
Qualcomm Multiple Chipsets. Attackers can corrupt memory in Qualcomm Multiple Chipsets, which they use to take it over. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-45519At work |
Synacor Zimbra Collaboration Suite (ZCS). Attackers can run commands on Synacor Zimbra Collaboration Suite (ZCS) from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-29824At work |
Ivanti Endpoint Manager (EPM). Attackers can run their own code on Ivanti Endpoint Manager (EPM) from anywhere, without logging in. | At work |
Companies
The flaws were in eleven companies’ products; the most were in Microsoft’s (4).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 4 | 2 |
| Ivanti | 3 | – |
| Fortinet | 2 | – |
| Cisco | 1 | – |
| Mozilla | 1 | 1 |
| Qualcomm | 1 | – |
| Roundcube | 1 | – |
| ScienceLogic | 1 | – |
| SolarWinds | 1 | – |
| Synacor | 1 | – |
| Veeam | 1 | 1 |
Other months
Every month since CISA started the list; October 2024 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.