CVE-2024-43573

Microsoft Windows MSHTML platform contains a spoofing vulnerability actively exploited in the KEV list that causes confidentiality loss.

This unspecified spoofing flaw in the MSHTML platform allows attackers to compromise confidentiality, likely through credential theft or session hijacking, posing a direct risk to DIB organizations relying on Windows-based systems. While not an RCE or zero-day, the active exploitation status and KEV inclusion signal a critical need for immediate patching to prevent data exfiltration.

Shame score — The vulnerability is actively exploited and listed in the KEV, indicating widespread impact, but the lack of specific details and the vendor's general release of a patch mitigates the embarrassment compared to known, avoidable failures.