Microsoft Patch Tuesday, August 2021 Edition

Summary: Microsoft released updates for at least 44 security vulnerabilities in Windows and related products, including CVE-2021-36948, an elevation-of-privilege flaw in the Windows Update Medic service that attackers are already exploiting. The release also addressed a critical Print Spooler flaw (CVE-2021-36936), a Remote Desktop client bug (CVE-2021-34535), and CVE-2021-26424, a TCP/IP vulnerability with a CVSS score of 9.9 affecting Windows 7 through Windows 10 and Windows Server 2008 through 2019.
What's compelling: One of the patched flaws sits in the very service Windows uses to repair and deliver updates, and Microsoft says it is already being exploited in the wild - a privilege-escalation foothold that attackers use to hide their tracks, create accounts, and maximize ransomware damage.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-26424 CVE-2021-34481 CVE-2021-34535 CVE-2021-36936 CVE-2021-36948
Related: Microsoft Patch Tuesday for August 2021 — Snort rules and prominent vulnerabilities Cyber Risks ·
CVE-2021-36948: Microsoft Windows Update Medic Service Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Threat Source newsletter (Aug. 12, 2021) Cyber Risks ·