Microsoft Patch Tuesday, May 2023 Security Update Review | Qualys

Summary: Microsoft's May 2023 Patch Tuesday addressed 49 vulnerabilities, six rated critical and 32 important, including two zero-days known to be exploited in the wild. The release also covered 11 vulnerabilities in Microsoft Edge (Chromium-based), with flaws spanning Windows Secure Boot, LDAP, NFS, SSTP, PGM, OLE, and SharePoint, and CISA added CVE-2023-29336 to its Known Exploited Vulnerabilities Catalog with a patch deadline of May 30, 2023.
Why it matters: One of the two exploited flaws, a Win32k vulnerability, lets an attacker with only local access gain SYSTEM privileges in a low-complexity attack requiring no privileges, and CISA's May 30 deadline leaves little room to test before you must patch.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-29336
Related: CVE-2023-29336: Microsoft Win32K Privilege Escalation Vulnerability Known Exploited Vulnerabilities · May 09, 2023
Microsoft Patch Tuesday, May 2023 Edition Cyber Risks ·
Microsoft Patch Tuesday for May 2023 — Fewest vulnerabilities disclosed in a month in three-plus years Cyber Risks ·