February 2024

CVE-2024-21401, the Microsoft Entra Jira SSO plugin elevation-of-privilege flaw, carries a CVSS 9.8 and has low attack complexity. An unauthenticated attacker can rewrite SAML metadata to redirect authentication from the owner's Entra ID tenant to the attacker's.

Kikta's real concern with the Jira bug is the secondary blast radius: IT, security, and engineering teams routinely store sensitive data in tickets, so a single takeover can chain into additional breaches if ticketing hygiene is weak.

CVE-2024-21351, a Windows SmartScreen security feature bypass, was exploited in the wild and lets an attacker inject code into SmartScreen itself after a user clicks a malicious file, removing a Mark of the Web defense layer.

CVE-2024-23218 in macOS Sonoma 14.3's CoreCrypto framework is a timing side channel that decrypts RSA PKCS#1 v1.5 ciphertexts without the private key. That standard has been deprecated since the late 1990s.

On patching cadence, Kikta is of both minds: a predictable schedule like Microsoft's lets teams plan policies and patching, while Apple's sporadic drops can swallow a day. He argues in-stream security updates for high-priority fixes, shipped the moment they are ready rather than held to a schedule, are how vendors bridge that gap.