Threat Source newsletter (Oct. 14, 2021)

Summary: Microsoft's October 2021 Patch Tuesday disclosed 77 vulnerabilities across its software, hardware and firmware, with only two rated critical — the fewest critical flaws in a Patch Tuesday in at least a year. Both critical bugs, CVE-2021-40461 in the Network Virtualization Service Provider and CVE-2021-38672 in Windows Hyper-V, allow remote code execution and carry a severity rating of 9.9 out of 10.
Why it matters: A 9.9-severity remote code execution flaw in Hyper-V and the Network Virtualization Service Provider means the virtualization layer many organizations treat as trusted infrastructure is itself the attack surface. Separately, Talos reports that CVE-2021-41733 in Apache HTTP Server 2.4.49 is being actively exploited in the wild, and the 2.4.50 fix was insufficient, requiring 2.4.51.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-38672 CVE-2021-40461 CVE-2021-41733 CVE-2021-42013
Related: Microsoft Patch Tuesday for Oct. 2021 — Snort rules and prominent vulnerabilities Cyber Risks ·
Patch Tuesday, October 2021 Edition Cyber Risks ·
Threat Advisory: Apache HTTP Server zero-day vulnerability opens door for attackers Cyber Risks ·