Microsoft Patch Tuesday, May 2021 Edition

Summary: Microsoft released fixes for at least 55 security holes in Windows and other software, four of which allow malware to seize complete remote control of vulnerable systems without user help. The most pressing is CVE-2021-31166, a wormable Windows 10 and Windows Server flaw that lets an unauthenticated attacker execute code by sending a specially-crafted packet, and Microsoft also patched CVE-2021-26419 in Internet Explorer 11, CVE-2020-24587 in Windows Wireless Networking, and four more Exchange Server holes.
What's compelling: CVE-2021-31166 sits 0.2 points from a perfect 10 CVSS score and needs no authentication, which researchers note makes it a prime target for ransomware operators - and any organization running the HTTP.sys protocol stack is exposed.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-24587 CVE-2021-26419 CVE-2021-31166
Related: Latest Microsoft Windows Updates Patch Dozens of Security Flaws Cyber Risks ·
CVE-2021-31166: Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Apr 06, 2022
Microsoft Patch Tuesday for May 2021 — Snort rules and prominent vulnerabilities Cyber Risks ·