Latest Microsoft Windows Updates Patch Dozens of Security Flaws
Summary: Microsoft's monthly security update patched 55 flaws across Windows, Exchange Server, Internet Explorer, Office, Hyper-V, Visual Studio, and Skype for Business, with four rated Critical, 50 Important, and one Moderate. Three of the vulnerabilities were publicly known but none were under active exploitation at release, and the most severe was CVE-2021-31166, a wormable remote code execution flaw in the HTTP protocol stack rated 9.8 on CVSS, alongside a Hyper-V remote code execution flaw, CVE-2021-28476, rated 9.9.
Key Takeaway: A wormable HTTP stack flaw at 9.8 and a Hyper-V bug at 9.9 mean an unauthenticated attacker could target servers and a guest VM could force the Hyper-V host's kernel to read from an arbitrary address, potentially compromising the host. This is also the third consecutive month of Exchange Server fixes since ProxyLogon exploits came to light in March.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-26419CVE-2021-28476CVE-2021-31166CVE-2021-31195CVE-2021-31207CVE-2021-31209
- Related
- Microsoft Patch Tuesday, May 2021 Edition Cyber Risks ·CVE-2021-31166: Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Apr 06, 2022CVE-2021-31207: Microsoft Exchange Server Security Feature Bypass Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021