Windows kernel bug now exploited in attacks to gain SYSTEM privileges

CISA has added two actively exploited, high-severity vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2024-35250, a Windows kernel privilege-escalation in MSKSSRV.SYS (used in a Pwn2Own demonstration and patched by Microsoft), and CVE-2024-20767, an Adobe ColdFusion unauthenticated path traversal/RCE with public proof-of-concept code and many internet-exposed servers; federal agencies are mandated to apply mitigations under BOD 22-01.