What is CVE-2024-49039?
Windows Task Scheduler contains a privilege‑escalation flaw that lets a locally‑run, attacker‑controlled program break out of its AppContainer sandbox and call privileged RPC interfaces. The vulnerability is identified as CVE-2024-49039. Microsoft has rated the risk as high, with a CVSS score of 8.8.
Related remediation guides
Other vulnerabilities in the same family or affecting the same products:
- CVE-2021-43226 – Windows CLFS Driver Privilege Escalation – What You Need to Do
- CVE-2025-29824 – Windows CLFS driver privilege‑escalation – what you need to know
- CVE-2026-26980 – Immediate Action Guide for Ghost Administrators
For the wider picture, our Known Exploited Vulnerabilities tracker lists every flaw CISA has confirmed under active attack.
Who should care?
If you manage any Windows workstation or server that runs the built‑in Task Scheduler, you need to read on. The flaw affects many Windows 10, Windows 11 and Windows Server releases. Anything that allows users to run scheduled tasks – which is practically every corporate PC and most servers – is in scope.
How does the flaw work?
Task Scheduler runs tasks inside an AppContainer when the task is marked as “run with limited privileges”. The container isolates the task from the rest of the system, preventing it from touching privileged resources. CVE-2024-49039 bypasses that isolation. An attacker can craft a malicious task that, when the scheduler launches it, gains the ability to invoke RPC calls that normally require system‑level rights. In practice that means the attacker can move from a low‑privilege account to full administrative control.
The public description from the National Vulnerability Database only mentions the outcome – privilege escalation via RPC – and does not disclose the exact code path. That is typical for a high‑impact flaw; the detailed exploit technique is kept private to stop casual attackers from reproducing it without the official exploit code.
How severe is it?
The CVSS base score of 8.8 puts this in the high‑severity bucket. Exploitation is not theoretical – it has been confirmed in the wild and is listed in the CISA Known Exploited Vulnerabilities catalog. CISA also notes that ransomware groups have used the bug as part of their infection chain. A successful attack can give an attacker full control of the host, allowing data theft, encryption, or lateral movement across the network.
Because the vulnerability lives in a core OS component that runs on virtually every Windows machine, the impact surface is large. If you are running an unpatched build, you are effectively exposing a backdoor to anyone with the ability to schedule a task – which includes many service accounts and even standard users in some configurations.
How to tell if you are exposed
First, verify which Windows build you are running. Open a command prompt and type:
systeminfo | findstr /B /C:"OS Version"
or simply run the winver GUI. Note the build number that appears – for example, a number like 19044.xxx – but do not write it down here. Compare that build against the table below. If your build falls into the “up to” range, you are on an affected version.
Second, check whether your organisation applies Windows Updates automatically. If you see that the latest cumulative update for your Windows branch has been installed, you are likely on the fixed release. If you are unsure, run:
wmic qfe get HotFixID, InstalledOn | findstr /I "KB"
Look for the most recent KB entry that corresponds to a cumulative update. The exact KB number is not required for this guide; the presence of a recent cumulative update usually means the patch for CVE-2024-49039 is present.
Mitigation and remediation
The only reliable fix is to apply the Microsoft‑provided patch that addresses the flaw. Microsoft released a security update that resolves the issue for each supported Windows branch. The guidance is simple:
- Open Settings → Update & Security → Windows Update.
- Select “Check for updates”.
- Install all available updates, making sure the cumulative update for your Windows branch is applied.
If you manage a large fleet with WSUS, SCCM, or another patch‑management tool, approve and push the latest cumulative update to all machines in the affected groups. Do not postpone – the update is classified as critical by Microsoft.
After installing, reboot the machine if prompted. Once the system comes back up, re‑run the systeminfo command to confirm the build number has moved past the “up to” range shown in the table.
What to do if a patch is unavailable
In rare cases a system may be locked to an older branch that cannot receive the new cumulative update (for example, legacy hardware that Microsoft no longer supports). In that situation you have two options:
- Apply mitigations. Microsoft recommends disabling the ability to create or run scheduled tasks that use the vulnerable code path. You can do this by setting the Group Policy
Computer Configuration → Administrative Templates → Windows Components → Task Scheduler → Disallow creation of scheduled tasksto “Enabled”. This stops new tasks from being added, but it also breaks legitimate automation that relies on the scheduler. - Isolate the machine. If you cannot patch and cannot afford the loss of scheduling functionality, move the host to a segmented network zone, restrict remote access, and monitor for any unusual RPC traffic. Use Windows Defender Exploit Guard or a third‑party endpoint protection product that can block the known exploit pattern.
Both mitigations are temporary. The safest route remains updating to a patched release.
Summary of actions
1. Run systeminfo or winver to see your build.
2. Compare the build to the table below. If you are in the “up to” column, you are vulnerable.
3. Open Windows Update and install the latest cumulative update for your Windows branch.
4. Reboot and verify the build has moved beyond the vulnerable range.
5. If you cannot patch, apply the Group Policy mitigation or isolate the system.
6. Keep an eye on CISA alerts for any new guidance.
Reference table
The table below lists the affected and fixed builds for each Windows edition. Use it as the definitive source – the numbers have been omitted from this text to avoid accidental misuse.
Affected versions
Straight from the NVD record for CVE-2024-49039. If your build is inside one of these ranges, treat it as vulnerable.
| Product | Affected range | Fixed in |
|---|---|---|
windows_10_1507 |
* up to 10.0.10240.20826 | 10.0.10240.20826 |
windows_10_1607 |
* up to 10.0.14393.7515 | 10.0.14393.7515 |
windows_10_1809 |
* up to 10.0.17763.6532 | 10.0.17763.6532 |
windows_10_21h2 |
* up to 10.0.19044.5131 | 10.0.19044.5131 |
windows_10_22h2 |
* up to 10.0.19045.5131 | 10.0.19045.5131 |
windows_11_22h2 |
* up to 10.0.22621.4460 | 10.0.22621.4460 |
windows_11_23h2 |
* up to 10.0.22631.4460 | 10.0.22631.4460 |
windows_11_24h2 |
* up to 10.0.26100.2314 | 10.0.26100.2314 |
windows_server_2016 |
* up to 10.0.14393.7515 | 10.0.14393.7515 |
windows_server_2019 |
* up to 10.0.17763.6532 | 10.0.17763.6532 |
windows_server_2022 |
* up to 10.0.20348.2849 | 10.0.20348.2849 |
windows_server_2022_23h2 |
* up to 10.0.25398.1251 | 10.0.25398.1251 |
