Microsoft Patch Tuesday, March 2021 Edition

Summary: Microsoft's March 2021 Patch Tuesday fixed more than 82 security flaws in Windows and other supported software, ten of them rated critical, including an Internet Explorer bug (CVE-2021-26411) under active exploitation that affects IE11 and EdgeHTML-based Edge. The batch also carried five DNS server flaws in Windows Server 2008 through 2019, each scored CVSS 9.8, and arrived amid the ongoing global Exchange Server mass-compromise. Microsoft pulled the March cumulative update KB5000802 after users reported blue screens when printing, particularly to Kyocera printers.
What's compelling: The actively exploited IE flaw was tied to a vulnerability ENKI researchers said nation-state actors used to target security researchers, and the researchers planned to publish proof-of-concept details once patched, which Tenable's Satnam Narang said attackers quickly fold into their toolkits. Meanwhile the DNS bugs drew a warning from Trend Micro's Dustin Childs of an outside chance of being wormable between DNS servers.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-26411
Related: CVE-2021-26411: Microsoft Internet Explorer Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Microsoft Patch Tuesday for March 2021 — Snort rules and prominent vulnerabilities Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026