Microsoft Patch Tuesday, September 2021 Edition

Summary: Microsoft's September 2021 Patch Tuesday fixed dozens of Windows security holes, four rated critical, including CVE-2021-40444 in the MSHTML component of Internet Explorer that attackers were already exploiting through Office applications and IE. The batch also covered CVE-2021-36965, a remote code execution flaw in WLAN AutoConfig, and CVE-2021-38647, an Azure Open Management Infrastructure bug with a CVSS score of 9.8 that Wiz.io estimated affects thousands of Azure customers and millions of endpoints.
Key Takeaway: Wiz.io found over 65% of the Azure tenants in its sample were unknowingly at risk from CVE-2021-38647, and CVE-2021-40444 was already being exploited in the wild before the patch shipped.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-28316 CVE-2021-30860 CVE-2021-36965 CVE-2021-36975 CVE-2021-38639 CVE-2021-38647 CVE-2021-40444
Related: Microsoft Patch Tuesday for Sept. 2021 — Snort rules and prominent vulnerabilities Cyber Risks ·
Threat Source newsletter (Sept. 16, 2021) Cyber Risks ·
CVE-2021-40444: Microsoft MSHTML Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021