NewsCompaniesFlawsGuides
Get the app

Flaws added in November 2024

From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in November 2024. For the newest, see Exploited flaws.

In November 2024, CISA added 22 flaws to its list of vulnerabilities being used in attacks, 5 of them in things people have at home; 5 have been used by ransomware gangs. Most came from Palo Alto Networks (5), Apple (2) and VMware (2).[1]

Most let an attacker take over the product, running their own code or taking full control. It was the second most CISA added in any month of 2024.

List of flaws

Every flaw CISA added in November 2024, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.

1 added

CVEFlawFound
CVE-2023-28461† Used in ransomwareAt work Array Networks AG/vxAG ArrayOS. Attackers can run their own code on Array Networks AG/vxAG ArrayOS from anywhere, without logging in. At work

3 added

CVEFlawFound
CVE-2024-44309At home Apple devices. Attackers can run code in the browser of someone using Apple devices and act as them. At home
CVE-2024-44308At home Apple devices. Attackers can run their own code on Apple devices. At home
CVE-2024-21287At work Oracle Agile Product Lifecycle Management (PLM). Attackers can reach parts of Oracle Agile Product Lifecycle Management (PLM) that should be locked to them from anywhere, without logging in. At work

2 added

CVEFlawFound
CVE-2024-38813At work VMware vCenter Server. Someone who already has a foothold can use VMware vCenter Server to take full control of the machine. At work
CVE-2024-38812At work VMware vCenter Server. Attackers can run their own code on VMware vCenter Server. At work

3 added

CVEFlawFound
CVE-2024-9474† Used in ransomwareAt work Palo Alto Networks PAN-OS. Attackers can run commands on Palo Alto Networks PAN-OS. At work
CVE-2024-1212At work Progress Kemp LoadMaster. Attackers can run commands on Progress Kemp LoadMaster from anywhere, without logging in. At work
CVE-2024-0012† Used in ransomwareAt work Palo Alto Networks PAN-OS. Attackers can use Palo Alto Networks PAN-OS to take full control of the machine from anywhere, without logging in. At work

2 added

CVEFlawFound
CVE-2024-9465At work Palo Alto Networks Expedition. Attackers can read or change the database behind Palo Alto Networks Expedition from anywhere, without logging in. At work
CVE-2024-9463At work Palo Alto Networks Expedition. Attackers can run commands on Palo Alto Networks Expedition from anywhere, without logging in. At work

5 added

CVEFlawFound
CVE-2024-49039† Used in ransomwareAt home Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. At home
CVE-2024-43451At home Microsoft Windows. Attackers can make something fake look genuine in Microsoft Windows. At home
CVE-2021-41277At work Metabase. Attackers can read files on Metabase that should be out of reach. At work
CVE-2021-26086At work Atlassian Jira Server and Data Center. Attackers can read files on Atlassian Jira Server and Data Center that should be out of reach. At work
CVE-2014-2120At work Cisco Adaptive Security Appliance (ASA). Attackers can run code in the browser of someone using Cisco Adaptive Security Appliance (ASA) and act as them. At work

4 added

CVEFlawFound
CVE-2024-5910At work Palo Alto Networks Expedition. Attackers can get into Palo Alto Networks Expedition without a valid password. At work
CVE-2024-51567† Used in ransomwareAt work CyberPersons CyberPanel. Attackers can run commands on CyberPersons CyberPanel from anywhere, without logging in. At work
CVE-2024-43093At home Android Framework. Someone who already has a foothold can use Android Framework to take full control of the machine. At home
CVE-2019-16278At work Nostromo nhttpd. Attackers can run their own code on Nostromo nhttpd. At work

2 added

CVEFlawFound
CVE-2024-8957At work PTZOptics PT30X-SDI/NDI Cameras. Attackers can run commands on PTZOptics PT30X-SDI/NDI Cameras from anywhere, without logging in. At work
CVE-2024-8956At work PTZOptics PT30X-SDI/NDI Cameras. Attackers can run their own code on PTZOptics PT30X-SDI/NDI Cameras from anywhere, without logging in. At work

Companies

The flaws were in 14 companies’ products; the most were in Palo Alto Networks’s (5).

CompanyFlawsRansomware
Palo Alto Networks52
Apple2–
Microsoft21
PTZOptics2–
VMware2–
Android1–
Array Networks11
Atlassian1–
Cisco1–
CyberPersons11
Metabase1–
Nostromo1–
Oracle1–
Progress1–

Other months

Every month since CISA started the list; November 2024 is outlined.

Flaws added to CISA’s list each month
YearJanFebMarAprMayJunJulAugSepOctNovDecTotal
2026 17282631212326314336 282
2025 142732152420201516311120 245
2024 2191010149141925172216 186
2023 5141817192416819181811 187
2022 40322264583483232412109 555
2021 29120 311
2026282 flaws
Jan17Feb28Mar26Apr31May21Jun23Jul26Aug31Sep43Oct36NovDec
2025245 flaws
Jan14Feb27Mar32Apr15May24Jun20Jul20Aug15Sep16Oct31Nov11Dec20
2024186 flaws
Jan21Feb9Mar10Apr10May14Jun9Jul14Aug19Sep25Oct17Nov22Dec16
2023187 flaws
Jan5Feb14Mar18Apr17May19Jun24Jul16Aug8Sep19Oct18Nov18Dec11
2022555 flaws
Jan40Feb32Mar226Apr45May83Jun48Jul3Aug23Sep24Oct12Nov10Dec9
2021311 flaws
JanFebMarAprMayJunJulAugSepOctNov291Dec20

References

  1. ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
  2. ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.

See also Exploited flaws, Companies, and Search for any app or company.