April’s Patch Tuesday includes 150 vulnerabilities, 60 which could lead to remote code execution
Summary: Microsoft disclosed 150 vulnerabilities in its April Patch Tuesday update, the largest monthly total since at least the start of 2023, including more than 60 that could lead to remote code execution. Only three issues are rated critical - CVE-2024-21322, CVE-2024-21323 and CVE-2024-29053, all remote code execution flaws in Microsoft Defender for IoT that Microsoft says are "less likely" to be exploited.
Why it matters: More than half of the code execution vulnerabilities sit in Microsoft SQL drivers, where an attacker can trick an authenticated user into connecting to a rogue SQL server over ODBC and deliver a malicious packet that runs code on the client - and Microsoft has flagged three other issues as "more likely" to be exploited.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-21322CVE-2024-21323CVE-2024-29053
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026