Microsoft Patch Tuesday - September 2018

Summary: Microsoft's September 2018 Patch Tuesday addressed 61 vulnerabilities, 17 rated critical, 43 important and one moderate, spanning Internet Explorer, the Jet Database Engine, the Chakra scripting engine and other products. The release included two critical advisories covering Adobe Flash and a Windows denial-of-service flaw, and among the listed bugs were remote code execution flaws in Hyper-V (CVE-2018-0965, CVE-2018-8439), Chakra, MSXML, Internet Explorer, the Windows font library and Microsoft Word 2013 and 2016. The elevation-of-privilege flaw CVE-2018-8440, in Windows handling of Advanced Local Procedure Call, was spotted in the wild as part of several pieces of malware.
What you should know: One of the 61 bugs, CVE-2018-8440, was already being used in malware in the wild, so the patch deadline for that flaw was effectively the day it shipped.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2018-0965 CVE-2018-8332 CVE-2018-8367 CVE-2018-8391 CVE-2018-8420 CVE-2018-8439 CVE-2018-8447 CVE-2018-8456 CVE-2018-8457 CVE-2018-8461 CVE-2018-8475
Related: Patch Tuesday, September 2018 Edition Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026