Is CVE-2024-42009 in the CISA Known Exploited Vulnerabilities catalog?

CVE-2024-42009 is not currently listed in the CISA KEV catalog.

Vulnerability intelligence

CVE-2024-42009 — Security Advisory

A suspected China-aligned campaign chained an XSS flaw patched in August 2024 with an RCE patched in mid-2025 to compromise physics and engineering departments at U.S. and Canadian universities. The gap is not disclosure — it is deployment.

2024

What WebPulse reported · 1 analysis

China-Aligned Hackers Chained Two Roundcube Flaws Against University Webmail. Both Were Patched Over a Year Ago.

A suspected China-aligned campaign chained an XSS flaw patched in August 2024 with an RCE patched in mid-2025 to compromise physics and engineering departments

July 8, 2026

View CVE-2024-42009 on the NIST National Vulnerability Database →

Related vulnerabilities

CVE-2024-6242 CVE-2024-34102