Microsoft Project 2016 vulnerabilities

2 CVEs affecting Microsoft Project 2016, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-38189, published 2024-08-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-38189: Microsoft Project Remote Code Execution Vulnerability, published 2024-08-13. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2024-08-13. EPSS: 8.2% chance of exploitation in the next 30 days. Microsoft Project Remote Code Execution Vulnerability
• CVE-2020-1449, published 2020-07-14. High severity, CVSS 7.8. EPSS: 4.6% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft Project software when the software fails to check the source markup of a file, aka 'Microsoft Project Remote Code Execution Vulnerability'.