During the month of March 2024, Microsoft has identified 61 vulnerabilities in their current OS. The most critical Common Vulnerabilities and Exposures (CVE’s) are noted below:
*There are 0 Windows Zero-Day vulnerabilities this month as of March 14th , 2024.*
Other Critical CVE’s worth mentioning:
- CVE-2024-26199 – Microsoft Office Elevation of Privilege Vulnerability
- Any authenticated user could trigger this vulnerability. It does not require admin or other elevated privileges.
- An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
- CVE-2024-20671 – Microsoft Defender Security Feature Bypass Vulnerability
- An authenticated attacker who successfully exploited this vulnerability could prevent Microsoft Defender from starting.
- CVE-2024-21411 – Skype for Consumer Remote Code Execution Vulnerability
- An attacker could exploit the vulnerability by sending the user a malicious link or a malicious image via Instant Message and then convincing the user to click the link or image.
- CVE-2024-21407 – Windows Hyper-V Remote Code Execution Vulnerability
- Guest-to-guest escape.
- Would require an authenticated attacker on a guest VM to send specially crafted file operation requests on the VM to hardware resources on the VM which could result in remote code execution on the host server.
- Could allow a user on a guest OS to execute arbitrary code on the host OS.
- CVE-2024-26198 – Microsoft Exchange Server Remote Code Execution Vulnerability
- Unauthenticated attacker could exploit the vulnerability by placing a specially crafted file onto an online directory or in a local network location then convincing the user to open it.
- CVE-2024-21334 – Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
- A remote unauthenticated attacker could access the OMI instance from the Internet and send specially crafted requests to trigger a use-after-free vulnerability.
- CVE-2024-21400 – Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
- Could allow attackers to gain elevated privileges and steal credentials.
3rd Party Critical CVE’s worth mentioning:
Adobe (not handled by FSRM):
- Adobe released 6 patches covering 56 CVE’s for Adobe Animate, Adobe Bridge, Adobe Experience Manager, ColdFusion, Lightroom and Premiere Pro.
Apple (not handled by FSRM):
Google Chrome:
- Version 122.0.6261.128/129 was released on March 12th . Most critical CVE is noted below:
- High CVE-2024-2400: Use after free in Performance Manager.
- Chrome Release: March 12th 2024
Additional Links:
Microsoft:
About FortressSRM Cyber Hygiene Offering:
Software vulnerabilities are one of the top cyber-attack vectors and one in three breaches are the result of vulnerabilities that were known about and should have been already patched1.
Keeping operating systems and application software patched and secure is time consuming and tedious – an internal IT resource nightmare. Fortress SRM’s Guardian Managed Patching with Monitoring Service delivers automated, high-efficacy (97%+) updates to Microsoft and over 80 third-party software, ensuring efficient patch deployment to every device, whether on or off network. This includes the deployment of critical updates, security updates, feature updates, operating system upgrades, key Windows security setting and configurations.
The Fortress SRM real-time reporting console includes current patch levels of devices and gives the Client total visibility into what patch related activities have been performed, while real-time patch monitoring provides deep insight into approved, unapproved, pending, and failed patching efforts.
Ready to start the Cyber Hygiene journey? Contact us at: Contact Us | Fortress Security Risk Management (fortresssrm.com)