Why Microsoft’s Critical Windows Vulnerabilities Should Be Taken Seriously: How to Secure Your Devices

Microsoft Patches Critical Windows Vulnerabilities and Warns of Code Execution Risks

Microsoft has released a significant update to patch multiple vulnerabilities affecting the Windows operating system and its software components. The updates released on Tuesday cover at least 70 documented vulnerabilities in the Windows ecosystem, including six critical issues that enable dangerous code execution attacks. While none of the vulnerabilities have been publicly exploited, network administrators are advised to be cautious of the highly critical bugs in Windows Pragmatic General Multicast (PGM), particularly the three vulnerabilities carrying a Common Vulnerability Scoring System (CVSS) score of 9.8/10. These vulnerabilities in the PGM protocol can be exploited remotely, leading to code execution. CVE-2023-29363, CVE-2023-32014, and CVE-2023-32015 are the three high-severity bugs affecting the PGM protocol.

PGM Vulnerabilities

While not enabled by default, PGM can be found in common configurations. This is the third month in a row for PGM to have a CVSS 9.8 bug addressed. Security experts anxiously monitor such issues, hoping their fixes come before any active exploitation occurs.

Remote Code Execution in Microsoft Exchange Server

Microsoft also highlighted the remote code execution bug in Microsoft Exchange Server, registered as CVE-2023-32021. This bug exposes users with accounts on the Exchange server to the attacker who successfully bypasses previous exploits. According to ZDI, successful exploitation can lead to the execution of code with SYSTEM privileges.

Adobe’s Fixes

On the same day as Microsoft’s update, Adobe released fixes for multiple security flaws in their Adobe Commerce software, formerly known as Magento. Adobe Commerce users are put at risk by at least 12 security issues identified in the product. Successful exploitation of these flaws results in a diverse range of repercussions, including code execution, arbitrary file system read, and security feature bypass.

Editorial

While no known exploits have been detected in the wild, users must update their systems to prevent any possible future vulnerabilities that may emerge. If left unpatched, exploitation could occur, leading to a range of consequences and offering cybercriminals full control of a user’s system. The updates also strengthen the argument for software vendors to customarily test their products thoroughly and ensure their products meet high security standards.

Advice

To aid in the prevention of cyber attacks, potential victims must regularly update their systems with the latest security patches and improve their cybersecurity measures. Administrators of Windows networks must look for updates and apply them to their systems, especially those addressing Windows Pragmatic General Multicast (PGM) vulnerabilities. System users must install updates as soon as they become available. Third parties can also provide security analysts and experts as a safety net to identify, isolate, and manage potential risks that system users may encounter.