Loading vulnerability…
CVE-2024-49039 is an elevation of privilege vulnerability in Windows Task Scheduler that affects the boundary between a low-privilege AppContainer context and higher-integrity Windows task scheduling functionality. Available reporting indicates the flaw stems from improper implementation of authentication and insufficient access control checks in Task Scheduler-related RPC functionality, including the WPTaskScheduler interface and associated library logic. A specially crafted local application running from a low-privilege AppContainer can abuse this weakness to invoke privileged RPC operations that should not be available to that security context. In observed exploitation, the vulnerability was used as a sandbox escape from a browser AppContainer and as a local privilege-escalation step by enabling creation and execution of scheduled tasks under elevated security contexts, including SYSTEM.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Small standalone repository containing a README and a single Python PoC script for CVE-2024-49039, a Windows Task Scheduler elevation-of-privilege/AppContainer escape issue. The exploit is not part of a larger framework. The main entry point is exploit.py, which accepts a user-provided command, verifies it is running on Windows, and attempts to create and execute a scheduled task using the Task Scheduler COM interface via comtypes. If requested, it can alternatively use schtasks.exe, generating a temporary UTF-16 XML task definition under the TEMP directory or C:\Windows\Temp, creating the task, running it, and optionally deleting it afterward. Core capability is arbitrary command execution through a newly registered scheduled task configured with elevated run settings, intended to demonstrate sandbox escape from Low integrity/AppContainer to a higher integrity context on unpatched systems. No external C2 or network infrastructure is present; the exploit is purely local and interacts with Windows Task Scheduler components, COM objects, task folders, temporary XML files, and schtasks.exe.
This repository provides a proof-of-concept (POC) exploit for CVE-2024-49039, a vulnerability in the WPTaskScheduler.dll component of Windows Task Scheduler (present since Windows 10 1507). The exploit leverages the Task Scheduler's RPC interface to create persistent scheduled tasks, bypassing sandbox and integrity restrictions (such as those imposed on Chrome renderer or AppContainer processes). The main entry point is 'main.cpp', which demonstrates both task creation (for persistence) and task enumeration/deletion via RPC calls. The exploit can be compiled as an executable or DLL (for reflective injection), and is tested on multiple Windows versions (Windows 10, 11, Server 2016). The codebase includes custom IDL definitions for the RPC interface, and uses the 'ncalrpc' protocol for local RPC communication. The exploit does not provide a weaponized payload but demonstrates the ability to persist and escalate privileges by abusing the vulnerable interface. No external network endpoints are used; all actions are performed locally via RPC and file system interactions.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Microsoft Windows Task Scheduler privilege escalation vulnerability that CISA KEV’s knownRansomwareCampaignUse field flipped from Unknown to Known (indicating evidence of ransomware campaign use).
A Windows privilege-escalation vulnerability reportedly chained with a Firefox bug to complete compromise and deliver a RomCom backdoor.
A Windows Task Scheduler vulnerability used as part of an exploit chain by RomCom (details not expanded in the provided content).
A vulnerability leading to arbitrary code execution in Firefox, Thunderbird, and the Tor Browser, exploited by RomCom.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.