Microsoft Patch Tuesday, April 2021 Edition

Summary: Microsoft released updates addressing at least 110 security holes in Windows and other products, including four fixes for Exchange Server (CVE-2021-28480 through CVE-2021-28483) that were all reported by the U.S. National Security Agency, with Microsoft also finding two internally. Nineteen vulnerabilities earned Microsoft's "Critical" label, and one Windows flaw (CVE-2021-28310) allowing privilege elevation is already being exploited in active attacks.
What's compelling: Two of the four Exchange flaws are pre-authentication, meaning an attacker needs no credentials to exploit a vulnerable server, and they arrive on the heels of a month of zero-day attacks on the same email software.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-28310 CVE-2021-28449 CVE-2021-28451 CVE-2021-28453 CVE-2021-28454 CVE-2021-28480 CVE-2021-28481 CVE-2021-28482 CVE-2021-28483
Related: Microsoft Patch Tuesday for April 2021 — Snort rules and prominent vulnerabilities Cyber Risks ·
Threat Source Newsletter (April 15, 2021) Cyber Risks ·
CVE-2021-28310: Microsoft Win32k Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021