Six critical vulnerabilities included in August’s Microsoft security update

Summary: Microsoft disclosed 73 vulnerabilities across its products in its August security update, six of them rated critical, and said one moderate-severity flaw, CVE-2023-38180, a denial-of-service issue in .NET and Visual Studio, has been actively exploited in the wild. Two critical remote code execution flaws, CVE-2023-29328 and CVE-2023-29330, sit in Microsoft Teams and are triggered by tricking a victim into joining an adversary-created meeting, while three more critical RCE flaws affect the Windows message queuing service and one affects Word.
What's compelling: The only flaw Microsoft confirms as exploited in the wild is rated moderate, not critical, and requires no user privileges or interaction, so severity labels alone will not tell you what is actually being used against you. The Teams flaws need only a meeting invite to land remote code execution in the victim's context, which puts the risk inside a collaboration tool most organizations treat as routine.

Read the original at Cisco Talos ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2023-29328 CVE-2023-29330 CVE-2023-35359 CVE-2023-35368 CVE-2023-35380 CVE-2023-35382 CVE-2023-35385 CVE-2023-35386 CVE-2023-35388 CVE-2023-36895 CVE-2023-36900 CVE-2023-36910 CVE-2023-36911 CVE-2023-38180 CVE-2023-38182 CVE-2023-38185
Related: Microsoft Patch Tuesday, August 2023 Edition Cyber Risks ·
CVE-2023-38180: Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability Known Exploited Vulnerabilities · Aug 09, 2023
New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026