Microsoft fixes 4 exploited zero-days and a code defect that nixed earlier security fixes
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2024-43461+2 related CVEs | Windows MSHTML Platform Spoofing Vulnerability Exploited as Zero-Day (CVE-2024-43461) | 8.8 group max | 54% | KEV | KEV |
CVE-2024-38018+3 related CVEs | Authenticated deserialization RCE in Microsoft SharePoint Server | 8.8 group max | 51% | ||
| CVE-2024-38226 | Actively Exploited Security Feature Bypass in Microsoft Publisher | 7.3 | 3% | KEV | KEV |
| CVE-2024-43491 | Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10… | 9.8 | 12% |
From the original article
4 min read at helpnetsecurity.com
September 2024 Patch Tuesday is here and Microsoft has delivered 79 fixes, including those for a handful of zero-days (CVE-2024-38217, CVE-2024-38226, CVE-2024-38014, CVE-2024-43461) exploited by attackers in the wild, and a Windows 10 code defect (CVE-2024-43491) that rolled back earlier CVE fixes.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.