CVE-2024-49039
Microsoft Windows Task Scheduler Privilege Escalation Vulnerability
Description
CVE-2024-49039 is a high-severity Windows Task Scheduler Elevation of Privilege Vulnerability affecting Microsoft Windows 10, Windows 11, and Windows Server editions from 2016 through 2025. Scoring 8.8 on the CVSS v3.1 scale, this vulnerability allows a locally authenticated attacker with low privileges to escape the security boundary and achieve full system compromise with high impact on confidentiality, integrity, and availability. Listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of December 3, 2024, this flaw has confirmed associations with known ransomware campaigns and carries an EPSS score of 0.66378 (98.5th percentile).
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20826 |
| microsoft | windows 10 1607 | < 10.0.14393.7515 |
| microsoft | windows 10 1809 | < 10.0.17763.6532 |
| microsoft | windows 10 21h2 | < 10.0.19044.5131 |
| microsoft | windows 10 22h2 | < 10.0.19045.5131 |
| microsoft | windows 11 22h2 | < 10.0.22621.4460 |
| microsoft | windows 11 23h2 | < 10.0.22631.4460 |
| microsoft | windows 11 24h2 | < 10.0.26100.2314 |
| microsoft | windows server 2016 | < 10.0.14393.7515 |
| microsoft | windows server 2019 | < 10.0.17763.6532 |
| microsoft | windows server 2022 | < 10.0.20348.2849 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1251 |
| microsoft | windows server 2025 | < 10.0.26100.2314 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49039(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-49039(US Government Resource)
Weakness Type
The specific CWE classification for CVE-2024-49039 has not been formally disclosed by Microsoft. The vulnerability resides in the Windows Task Scheduler service, where a flaw in privilege boundary enforcement allows a low-privileged process to escalate to SYSTEM-level permissions. This type of weakness generally falls under improper privilege management, where the Task Scheduler fails to adequately validate or restrict the actions that a lower-privileged user or process can perform through its interfaces. The scope change in the CVSS vector (S:C) indicates that the exploit breaks out of the vulnerable component's security authority, affecting resources beyond the Task Scheduler itself.
Impact Analysis
CVE-2024-49039 delivers a devastating triple impact across confidentiality, integrity, and availability, all rated High in the CVSS assessment. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) with a Scope of Changed means an attacker who gains initial low-privilege access — even through a basic user account — can escalate to SYSTEM privileges and take complete control of the affected machine. Business consequences include complete data exfiltration capability, ability to install persistent backdoors, disable security controls, encrypt filesystems for ransomware, and pivot to other systems using the compromised machine's elevated credentials. The EPSS score of 0.66378 places this vulnerability in the 98.5th percentile, and CISA has confirmed its association with known ransomware campaigns, making it a critical threat for organizations of any size. The fact that this vulnerability has been linked to ransomware operations dramatically increases the urgency, as exploitation can directly lead to operational disruption, data loss, and extortion demands.
Exploit Maturity
CVE-2024-49039 is confirmed as actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of December 3, 2024. Critically, the ransomware usage is classified as "Known," meaning this vulnerability has been directly leveraged in ransomware campaigns. The EPSS score of 0.66378 (98.5th percentile) reflects a very high exploitation probability. The local attack vector requires the attacker to first obtain low-privilege code execution on the target, which is commonly achieved through phishing, drive-by downloads, or exploitation of other vulnerabilities. Once initial access is established, the Task Scheduler vulnerability provides a reliable privilege escalation path that is valuable in multi-stage attack chains. The combination of confirmed ransomware usage and active exploitation makes this one of the most dangerous privilege escalation vulnerabilities in the current threat landscape.
Remediation
- Apply Microsoft security updates immediately — Download and install the patches from the Microsoft Security Response Center advisory for all affected Windows versions, prioritizing systems where users have local interactive access.
- Restrict local user privileges — Review and minimize the number of users with local logon rights, and enforce the principle of least privilege to reduce the pool of accounts that could be used as initial access vectors.
- Harden Task Scheduler configurations — Audit existing scheduled tasks for unnecessary elevated privileges, restrict who can create or modify scheduled tasks through Group Policy, and monitor for suspicious task creation events.
- Deploy endpoint detection and response (EDR) — Ensure EDR solutions are configured to detect privilege escalation attempts, unusual Task Scheduler activity, and post-exploitation behaviors such as credential dumping or lateral movement.
- Implement application control policies — Use Windows Defender Application Control (WDAC) or AppLocker to restrict which executables can run, limiting an attacker's ability to execute the exploit payload even after achieving initial access.
Technical Details
The CVSS v3.1 vector for CVE-2024-49039 is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, yielding a base score of 8.8 (High). Attack Vector (Local) means the attacker must have local access to the system, either through an interactive session or by executing code locally. Attack Complexity (Low) indicates the exploit works reliably without requiring special conditions or race conditions. Privileges Required (Low) confirms that a basic unprivileged user account is sufficient to trigger the vulnerability. User Interaction (None) means no victim action beyond the attacker's own code execution is needed. Scope (Changed) is a critical indicator — the exploitation crosses a security boundary, affecting components outside the Task Scheduler's own authority. This typically means escalation from user-level to SYSTEM-level privileges. Confidentiality, Integrity, and Availability (all High) reflect complete compromise of the target system. The attack mechanism exploits a flaw in how the Windows Task Scheduler service handles privilege boundaries, allowing a crafted request from a low-privileged process to execute operations with SYSTEM-level permissions. This provides the attacker with unrestricted access to all files, registry keys, services, and security subsystems on the machine.
Frequently Asked Questions
What is CVE-2024-49039?
CVE-2024-49039 is a Windows Task Scheduler Elevation of Privilege Vulnerability that allows a low-privileged local attacker to escalate to SYSTEM-level permissions on affected Microsoft Windows systems. It affects Windows 10, Windows 11, and Windows Server editions from 2016 through 2025.
Is CVE-2024-49039 used in ransomware attacks?
Yes, CISA has confirmed that this vulnerability is associated with known ransomware campaigns. Attackers use it as part of multi-stage attacks where initial low-privilege access is escalated to full system control, enabling ransomware deployment across the compromised environment.
How critical is CVE-2024-49039?
With a CVSS score of 8.8 (High), confirmed ransomware usage, and an EPSS score in the 98.5th percentile, this is one of the most dangerous privilege escalation vulnerabilities currently being exploited. The Scope Changed designation means the impact extends beyond the vulnerable component to the entire system.
How can I mitigate CVE-2024-49039?
Apply Microsoft's security patches immediately from the MSRC advisory. Additionally, restrict local user privileges, harden Task Scheduler configurations through Group Policy, deploy EDR solutions to detect escalation attempts, and implement application control policies to limit unauthorized code execution.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.