Microsoft’s latest security update for July has revealed a staggering 130 unique vulnerabilities, highlighting the pressing need for users to promptly apply the patches. Among these vulnerabilities, five are already being actively exploited in the wild, posing a significant threat to users worldwide.
CVE-2023-36884: Unpatched Remote Code Execution (RCE) Bug
The most critical vulnerability identified is CVE-2023-36884, which allows remote code execution in Office and Windows HTML. Unfortunately, Microsoft did not include a patch for this bug in the July update, raising concerns about the potential impact on users and the urgent need for a solution.
Actively exploited vulnerabilities
Attackers have already targeted two actively exploited vulnerabilities affecting Microsoft Outlook and Windows SmartScreen. These security bypass flaws allow threat actors to circumvent security measures, compromising systems and potentially gaining unauthorized access to sensitive data.
Zero-day exploits enabling privilege escalation
The July security update addresses three zero-day vulnerabilities, all enabling privilege escalation. Among these, a critical elevation of privilege flaw in the Windows Error Reporting (WER) service is particularly noteworthy. Additionally, a bug in Microsoft’s Windows MSHTML platform has been exploited to elevate user privileges, further emphasizing the importance of applying the update to mitigate these risks.
RCE Vulnerabilities in Windows Routing and Remote Access Service (RRAS)
Security researchers have identified three Remote Code Execution (RCE) vulnerabilities in the Windows Routing and Remote Access Service (RRAS) that demand immediate attention. Exploiting these flaws could enable threat actors to gain unauthorized access to networks, compromising system integrity and potentially leading to data breaches.
RCE Vulnerabilities in SharePoint Server
Microsoft’s July update includes fixes for four remote code execution (RCE) vulnerabilities in SharePoint Server, which has emerged as a popular target for attackers. Organizations heavily reliant on SharePoint should promptly apply these patches, as successful exploitation of these vulnerabilities could have severe consequences for data confidentiality and system availability.
CVE-2023-35332: Attention for Compliance-Regulated Organizations
Compliance-regulated organizations, such as those adhering to FEDRAMP, PCI, HIPAA, SOC2, and similar regulations, should pay close attention to the vulnerability labeled CVE-2023-35332. Proactively addressing this vulnerability is crucial for maintaining regulatory compliance and safeguarding sensitive information from malicious actors.
Investigation into Threat Actors Using Certified Drivers
Microsoft has published an advisory regarding recent reports of threat actors leveraging drivers certified under the Windows Hardware Developer Program (WHDP) for post-exploit activities. This investigation sheds light on the potential exploitation of trusted resources and highlights the need for enhanced security measures, such as regular driver updates and heightened scrutiny of third-party software.
Unusual Volume of Fixes
This July security update from Microsoft marks one of the highest numbers of fixes released in recent years. While it may seem unusual, it’s not uncommon for Microsoft to release a significant number of patches ahead of events like the Black Hat USA conference. However, the high number of vulnerabilities addressed emphasizes the critical importance of promptly applying the update to ensure system security.
Microsoft’s July security update, with fixes for an extensive range of vulnerabilities, serves as a stark reminder of the ever-evolving landscape of cybersecurity threats. With actively exploited zero-days and critical vulnerabilities demanding immediate attention, users must diligently apply the necessary updates to safeguard their systems and data. Regular patching, coupled with proactive security measures, remains vital in fortifying against the relentless efforts of digital adversaries.