Microsoft Issues Patches for In-the-Wild 0

CVE-2020-1472, widely known as "Zerologon," is an elevation-of-privilege flaw in how the Netlogon secure channel is established over the Netlogon Remote Protocol (MS-NRPC) on Microsoft domain controllers. An unauthenticated attacker with network reachability to a domain controller sends specially crafted Netlogon messages to establish a vulnerable secure channel and then runs a specially crafted application on the network to obtain domain administrator access. Successful exploitation yields domain administrator privileges, effectively full compromise of the Active Directory environment, and the flaw is known to be used in ransomware operations. Any organization running affected Windows Server versions (2008 through 20H2) as domain controllers is exposed, along with environments using Netlogon implementations from Samba and distributions or products from Fedora, openSUSE, Canonical (Ubuntu), Debian, Synology, and Oracle. Exploitation is highly active: a public Zerologon PoC/exploit is available, the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, with known ransomware use), and EPSS estimates a 99.4% probability of exploitation within 30 days.

Do: Apply the vendor updates on all domain controllers and other affected systems immediately, following Microsoft's two-phase Netlogon secure channel guidance (the enforcement phase of the phased rollout began in Q1 2021). Audit Netlogon secure-channel connections and event logs for clients still using vulnerable connections before enabling full enforcement, and install updated packages for Samba and other Netlogon implementations from Fedora, openSUSE, Ubuntu, Debian, Synology, and Oracle. Given known ransomware use, prioritize patching any domain controller reachable from user networks, VPNs, or the internet.

Windows TCP/IP Remote Code Execution Vulnerability

CVE-2021-1732 is a local elevation-of-privilege vulnerability (CWE-787, out-of-bounds write) in Microsoft's Win32k kernel driver, publicly characterized as an "offset confusion" in the Win32k ConsoleControl routine. It is triggered locally: a process with only low privileges can invoke the vulnerable Win32k functionality without any user interaction, causing a user-supplied offset/pointer to be mishandled in kernel mode and memory to be written out of bounds. An attacker who successfully exploits the flaw can execute code in the kernel and elevate to SYSTEM, gaining full control of the host — which makes it a valuable second-stage link in malware and ransomware chains. Any system running the affected Windows 10 releases (1803, 1809, 1909, 2004, 20H2) or Windows Server 2019/1909/2004/20H2 is exposed, though exploitation requires the attacker to already run code locally on the target. The flaw was fixed in Microsoft's February 2021 Patch Tuesday updates, was added to CISA's KEV catalog on 2021-11-03 with known ransomware use, and carries a very high EPSS score (78.4%, 100th percentile), indicating sustained exploitation pressure.

Do: Apply Microsoft's February 2021 (or later) Windows cumulative security updates to all affected Windows 10 and Windows Server systems, per vendor instructions — CISA's KEV listing requires federal agencies to patch. Prioritize hosts exposed to untrusted local users or already compromised by malware (e.g., ransomware or Raspberry Robin activity, which has used chained Windows LPEs), and hunt on unpatched hosts for signs of post-exploitation privilege escalation to SYSTEM.

CVE-2021-21017 is a heap-based buffer overflow (out-of-bounds write, CWE-122/CWE-787) in Adobe Acrobat and Reader DC that corrupts memory when a specially crafted PDF is processed. Exploitation requires user interaction: a victim must open the malicious PDF file, after which an unauthenticated, network-based attacker can execute arbitrary code in the context of the current user. Successful exploitation effectively gives the attacker the privileges of the victim user on the endpoint, including the ability to run programs and read or modify data. Users running Acrobat Reader DC or Acrobat DC at or below versions 2020.013.20074, 2020.001.30018, or 2017.011.30188 on the Continuous, Classic 2020, and Classic 2017 tracks are affected. The bug was addressed in Adobe's February 2021 updates but has been exploited in the wild - it was added to the CISA KEV catalog on 2021-11-03 - and EPSS assigns an 86.3% probability of exploitation within 30 days (100th percentile).

Do: Upgrade all Acrobat and Reader installations to Adobe's February 2021 patched releases or later, per the vendor's instructions, as required by CISA KEV (added 2021-11-03). Inventory endpoints running Continuous, Classic 2020, or Classic 2017 builds at or below the listed versions and verify the running version after patching. Until patched, avoid opening PDFs from untrusted sources, since exploitation requires a victim to open a malicious file.

Windows DNS Server Remote Code Execution Vulnerability

Microsoft Edge for Android Information Disclosure Vulnerability

Microsoft Teams iOS Information Disclosure Vulnerability

.NET Core Remote Code Execution Vulnerability