Actively Exploited Zero-Day, Critical RCEs Lead Microsoft Patch Tuesday

Microsoft's December 2024 Patch Tuesday delivers 71 fixes (1,020 for the year) and calls out an actively exploited Windows CLFS zero-day allowing privilege escalation (CVE-2024-49138), a critical unauthenticated LDAP RCE that can compromise Domain Controllers (CVE-2024-49112, CVSS 9.8), Hyper-V guest-to-host/cross-VM RCE (CVE-2024-49117), and multiple high-severity Remote Desktop Service vulnerabilities; administrators are advised to prioritize immediate patching due to active exploitation and high-impact consequences.